WWBN AVideo EUVD-2026-69725

Exploitation requires only network-level access to the encryptPass.json.php endpoint - no authentication, account credentials, or special configuration is needed, as the HMAC key is the site's public base URL which any visitor can observe. The current time is also an input to the token computation, but since the attacker controls the request timing, this is not a meaningful constraint. The full chained impact (offline credential recovery) additionally requires the attacker to have separately obtained a copy of the AVideo user password database through an independent compromise vector. Without a stolen database, the attack yields hashes only for attacker-supplied inputs, limiting standalone impact to hash oracle information disclosure. The vulnerability is present in all AVideo deployments through commit 9c39d8c8 regardless of configuration.

The CVSS 4.0 score of 6.9 with AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N accurately captures the direct, standalone impact: low confidentiality exposure (hash oracle output for attacker-chosen inputs) with no integrity or availability consequence. Real-world risk is context-dependent and elevated in a chained scenario: if an attacker has separately exfiltrated an AVideo user database, this oracle collapses offline cracking difficulty by providing on-demand hash generation without server-side rate limiting or lockout. As a standalone attack with no stolen database, the immediate impact is limited. No KEV listing and no identified public exploit code indicate the vulnerability is not currently being mass-exploited. EPSS data is absent from provided inputs, so exploitation probability cannot be quantified from available signals. The primary realistic threat is a motivated attacker targeting a specific AVideo instance post-breach, not automated mass exploitation.

An attacker identifies a public AVideo installation, notes the base URL (e.g., https://example.com/avideo), and sends unauthenticated HTTP requests to encryptPass.json.php with attacker-chosen passwords, collecting the resulting HMAC-derived hashes for each input. Using a separately obtained dump of the AVideo user table, the attacker cross-references stored hashes against their precomputed oracle output, recovering plaintext credentials without triggering server-side authentication lockouts or rate limits. No exploit code is publicly confirmed, but the attack requires only basic HTTP tooling and knowledge of the public URL.