Authentication Bypass in AVideo LoginControl via PGP Verification

AVideo LoginControl contains an authentication bypass vulnerability within its PGP second-factor verification process. The vulnerability stems from an insecure implementation of challenge response verification that uses loose equality comparison (==) against an uninitialized session variable. Because the code evaluates an uninitialized session variable as null, an attacker possessing a victim's account password can trigger this bypass by submitting a parameter-less GET request to the 'verifyChallenge.json.php' endpoint. This results in a condition where the check evaluates null == null, allowing the system to erroneously mark the second-factor authentication as complete. This flaw grants unauthorized access to accounts that have PGP-based multi-factor authentication enabled, effectively negating the security controls intended to protect these identities. Defenders should identify instances of AVideo LoginControl and monitor web server access logs for anomalous requests to the identified verification endpoint.

Impact

Successful exploitation of CVE-2026-92914 allows unauthenticated actors who have obtained valid user credentials to bypass second-factor authentication controls. This leads to unauthorized account access, potential data exfiltration, and persistence within the application environment. The severity is assessed as high due to the bypass of critical authentication controls in enterprise media management workflows.

Recommendation

• Deploy the provided Sigma rule to detect suspicious access to the vulnerable verification endpoint.
• Review web server logs for requests to 'verifyChallenge.json.php' that lack expected parameters or authentication headers.
• Identify all instances of AVideo LoginControl within the environment and coordinate with the vendor or upstream project for available security patches.