Authentication Bypass in AVideo via Parameter Manipulation

AVideo through commit 9c39d8c8 contains a critical authentication bypass vulnerability due to flawed validation logic within the deduplicateByEncoderQueueId() and useVideoHashOrLogin() functions. The software fails to perform proper ownership verification when the videos_id parameter is omitted during an upload process, causing the system to return a video_id_hash belonging to any video, including those owned by administrators. Because the useVideoHashOrLogin() function treats this hash as a valid credential for passwordless login, an attacker can leverage a captured hash to authenticate as the video owner. This flaw allows an attacker with low-privileged upload access to escalate privileges to the administrator level, enabling full system configuration control. This vulnerability highlights the risks of implicit trust in video identifier hashes for session management.

Impact

Successful exploitation allows for full administrative account takeover within an AVideo instance. Attackers can modify system configurations, manage user accounts, and potentially gain access to sensitive media content. This is particularly critical for enterprise or public-facing video platforms where AVideo is used to manage high-privileged administrative accounts.

Recommendation

• Apply patches or upgrade AVideo instances to a version beyond commit 9c39d8c8 to address the logic error in ownership verification.
• Monitor web server logs for anomalous POST or GET requests to upload endpoints where the videos_id parameter is absent or manipulated.
• Audit current AVideo session management logs for unusual passwordless login patterns involving video_id_hash parameters.