WWBN AVideo: Incorrect authorization vulnerability (CVE-2026-126805)
WWBN AVideo through version 29.7.1 is vulnerable to an incorrect authorization issue in the encoder endpoint, allowing delegated administrators to bypass authentication and achieve administrative access via hash replay.
CVE search metadata
CVE search record: CVE-2026-126805. Severity: high. CVSS: 7.2. KEV: no. Product: AVideo (<= 29.7.1). Brief: WWBN AVideo: Incorrect authorization vulnerability (CVE-2026-126805). Brief link: https://feed.craftedsignal.io/briefs/2026-11-avideo-auth-bypass-cve-2026-126805/
Triage facts
Revision 1- Applicability
- AVideo (<= 29.7.1)
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 22:08 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
WWBN AVideo through 29.7.1 contains an incorrect authorization vulnerability that allows delegated Videos Admin users to obtain video_id_hash values bound to any video owner. This vulnerability manifests via the aVideoEncoderStatus.json.php endpoint.
Impact
Successful exploitation allows an attacker to request the hash for an administrator-owned video and replay it using the useVideoHashOrLogin() function. This facilitates password-less login, granting the attacker access to administrative functions, including plugin uploads, configuration changes, and user management.
Recommendation
Immediately inventory all instances of WWBN AVideo. As of this report, users should monitor for suspicious authentication activity associated with the useVideoHashOrLogin function. Prioritize restricted access to the aVideoEncoderStatus.json.php endpoint until a vendor-supplied patch is applied.
Immediate actions
Inventory all WWBN AVideo deployments and restrict access to the aVideoEncoderStatus.json.php endpoint.
Threat Hunt
Investigate web server logs for suspicious requests to aVideoEncoderStatus.json.php that originate from users with 'Videos Admin' privileges.
Data: Web server access logs