CVE-2026-43875: WWBN AVideo account takeover via password hash leak in MobileManager

Executive brief

AVideo is an open-source video platform. A security flaw in its mobile management plugin allows an attacker to take over user accounts, including administrator accounts, by capturing sensitive login data leaked in web addresses. This could lead to unauthorized access to private videos, site configuration changes, and full control over the platform's content.

Technical details

A vulnerability exists in `plugin/MobileManager/oauth2.php` where the application appends the user's raw password hash to an HTTP 302 redirect URL during OAuth authentication. This hash is subsequently exposed in server logs, browser history, and Referer headers. Because the AVideo login endpoint (`objects/login.json.php`) supports an `encodedPass=1` parameter that performs direct string comparison against the stored hash instead of verifying a plaintext password, an attacker who captures the hash can use it as a valid credential. The attack requires the MobileManager plugin to be enabled and a victim to perform an OAuth login. No patch is currently available for version 29.0 and below.

Affected products

• WWBN AVideo <= 29.0

Timeline

• 2026-05-05: advisory: GitHub Advisory published

References

• https://api.github.com/users/offset
• https://github.com/offset
• https://api.github.com/users/offset/gists%7B/gist_id%7D
• https://api.github.com/users/offset/repos
• https://avatars.githubusercontent.com/u/114768995?v=4
• https://api.github.com/users/offset/events%7B/privacy%7D