Executive brief
AVideo is a video hosting and management platform. An authentication bypass flaw allows attackers with basic upload permissions to steal administrator credentials and gain full system access. An attacker can retrieve an admin's video hash through a single API call, then use that hash in a second request to log in as the administrator and modify system settings or read sensitive data like email addresses.
Technical details
The vulnerability exists in objects/aVideoEncoder.json.php where the deduplicateByEncoderQueueId() function returns a video_id_hash (which functions as a bearer credential) for any video identified by encoder_queue_id, without verifying ownership. The only ownership check (Video::canEncoderEdit()) is guarded by a parameter check that the attacker omits, bypassing it entirely. The video_id_hash is then accepted by useVideoHashOrLogin() which decrypts it and calls User::login(true) with the noPass flag, performing password-less login as the video owner. Preconditions: an attacker needs upload permission (granted by default self-registration) and the target video must have an encoder_queue_id field. The attack requires two network requests—one authenticated to obtain the hash, one unauthenticated to convert it to a session. No patch has been released as of the advisory date.
Affected products
- WWBN AVideo through commit 9c39d8c8
Timeline
- 2026-08-22: disclosed