{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/avideo--24.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-59808"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AVideo","AVideo (\u003c 24.0)"],"_cs_severities":["high"],"_cs_tags":["authentication-bypass","privilege-escalation","web-application","ssrf","vulnerability"],"_cs_type":"advisory","_cs_vendors":["AVideo"],"content_html":"\u003cp\u003eAVideo through commit 9c39d8c8 contains a critical authentication bypass vulnerability due to flawed validation logic within the \u003ccode\u003ededuplicateByEncoderQueueId()\u003c/code\u003e and \u003ccode\u003euseVideoHashOrLogin()\u003c/code\u003e functions. The software fails to perform proper ownership verification when the \u003ccode\u003evideos_id\u003c/code\u003e parameter is omitted during an upload process, causing the system to return a \u003ccode\u003evideo_id_hash\u003c/code\u003e belonging to any video, including those owned by administrators. Because the \u003ccode\u003euseVideoHashOrLogin()\u003c/code\u003e function treats this hash as a valid credential for passwordless login, an attacker can leverage a captured hash to authenticate as the video owner. This flaw allows an attacker with low-privileged upload access to escalate privileges to the administrator level, enabling full system configuration control. This vulnerability highlights the risks of implicit trust in video identifier hashes for session management.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full administrative account takeover within an AVideo instance. Attackers can modify system configurations, manage user accounts, and potentially gain access to sensitive media content. This is particularly critical for enterprise or public-facing video platforms where AVideo is used to manage high-privileged administrative accounts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply patches or upgrade AVideo instances to a version beyond commit 9c39d8c8 to address the logic error in ownership verification.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for anomalous POST or GET requests to upload endpoints where the \u003ccode\u003evideos_id\u003c/code\u003e parameter is absent or manipulated.\u003c/li\u003e\n\u003cli\u003eAudit current AVideo session management logs for unusual passwordless login patterns involving \u003ccode\u003evideo_id_hash\u003c/code\u003e parameters.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-27T19:10:41Z","date_published":"2026-08-22T15:30:44Z","id":"https://feed.craftedsignal.io/briefs/2026-08-avideo-auth-bypass/","summary":"An authentication bypass vulnerability in AVideo (CVE-2026-59808) allows attackers with upload access to hijack administrative sessions via improper video ownership verification.","title":"Authentication Bypass in AVideo via Parameter Manipulation","url":"https://feed.craftedsignal.io/briefs/2026-08-avideo-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - AVideo (\u003c 24.0)","version":"https://jsonfeed.org/version/1.1"}