Executive brief
WWBN AVideo is a video platform software that uses a bearer token called video_id_hash to authenticate video encoders. This token is designed to grant access to a specific video, but instead grants full administrator privileges to the entire system and never expires or revokes—even when the account password is changed. An attacker who obtains this token can replay it indefinitely to gain complete control of the video platform.
Technical details
The vulnerability is an authentication and privilege management failure in how video_id_hash credentials are generated and validated. The hash is created with no expiry time, nonce, or binding to the account owner—it contains only the video ID encrypted with a fixed, deterministic IV derived from the installation root path. When presented to the encoder endpoint, it is exchanged for a full authenticated session with admin rights via the useVideoHashOrLogin() function, which performs a forced login with no password verification. Because encryption is deterministic, the same hash is generated every time for a given video and cannot be rotated per-video. The credential persists indefinitely and survives password changes; it can only be invalidated by disabling the owner's account or changing the global saltV2 key. An unauthenticated attacker who learns or intercepts a video_id_hash can replay it to gain full administrative access to the AVideo installation.
Affected products
- WWBN AVideo version 29.0 and earlier
Timeline
- 2026-08-19: disclosed
- 2026-09-03: advisory