AVideo EUVD-2026-81435

Exploitable against default AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1 because plugin/API/set.json.php?APIName=login_code is reachable without authentication and leaks server microtime, and getRandomCode() in objects/functions.php uses uniqid()-derived pseudo-randomness. Limiting factors: the attacker must guess a code that exists only while a legitimate activation/login-pairing code is outstanding and unexpired (10-minute TTL), must align to the code's generation second and brute-force the residual ~2^25 space within that window (hence CVSS AC:H/AT:P), and success depends on a valid pairing code being live at the time of attack. No authentication, no user interaction, and no non-default configuration are required - only the timed probabilistic guess.

This is a genuine unauthenticated remote account-takeover primitive, but its real-world exploitability is meaningfully tempered by the attack complexity, which is why the vendor's CVSS 4.0 vector correctly carries AC:H and AT:P despite a 9.1 headline. The flaw is real and high-value: the CWE-330 weak PRNG (getRandomCode() built from uniqid()) collapses the code space to ~2^25 for a known generation second, and the design mistake of leaving plugin/API/set.json.php?APIName=login_code unauthenticated hands the attacker a microtime oracle that makes the 'known second' assumption practical rather than theoretical. Success yields both the target email and a User::getUserHash('+1 year') value accepted as a password substitute for a full year - a durable, high-integrity compromise. Against that, the attacker must win a probabilistic guess against a code that expires in 10 minutes, aligning microtime and brute-forcing the residual space within the window, so exploitation is a timed race rather than a single deterministic request (AT:P/AC:H). No EPSS score, no CISA KEV listing, and no public exploit code are present in the input; per the precision rules this is 'no public exploit identified at time of analysis.' There are no conflicting signals to flag beyond the tag nuance - the CVSS network vector matches the description, and prioritization should treat this as a real high-severity ATO bug on affected AVideo instances, with the important caveat that no patched version exists, so mitigation is compensating-control only.

An unauthenticated attacker repeatedly calls plugin/API/set.json.php?APIName=login_code to read the server's exact microtime, then brute-forces the ~2^25 uniqid()-derived code space for a recently-generated, still-valid pairing code (10-minute TTL). Once a valid code is guessed, they redeem it at plugin/API/get.json.php?APIName=login_code to retrieve the victim's email and a one-year User::getUserHash credential, logging in as the victim. No public exploit code is identified at time of analysis.