# CVE-2026-85154: WWBN AVideo authentication bypass in video_id_hash credential

Source: https://junglewise.ai/threats/cve-2026-85154-wwbn-avideo-authentication-bypass-in-video-id-hash-credential  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-85154 · Severity: critical · CVSS 9.8 · Published 2026-09-03

WWBN AVideo is a video platform software that uses a bearer token called video_id_hash to authenticate video encoders. This token is designed to grant access to a specific video, but instead grants full administrator privileges to the entire system and never expires or revokes—even when the account password is changed. An attacker who obtains this token can replay it indefinitely to gain complete control of the video platform.

Technologies: [WWBN AVideo](https://junglewise.ai/threats/technologies/avideo). Vendors: [WWBN](https://junglewise.ai/threats/vendors/wwbn).

## Quick answers

**Is CVE-2026-85154 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85154 being exploited in the wild.

**How severe is CVE-2026-85154?** Critical severity, with a CVSS score of 9.8, published 3 September 2026.

**Which products and versions are affected?** WWBN AVideo version 29.0 and earlier.

**Is there a fix for CVE-2026-85154?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85154 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-85154?** Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication and privilege management failure in how video_id_hash credentials are generated and validated. The hash is created with no expiry time, nonce, or binding to the account owner—it contains only the video ID encrypted with a fixed, deterministic IV derived from the installation root path. When presented to the encoder endpoint, it is exchanged for a full authenticated session with admin rights via the useVideoHashOrLogin() function, which performs a forced login with no password verification. Because encryption is deterministic, the same hash is generated every time for a given video and cannot be rotated per-video. The credential persists indefinitely and survives password changes; it can only be invalidated by disabling the owner's account or changing the global saltV2 key. An unauthenticated attacker who learns or intercepts a video_id_hash can replay it to gain full administrative access to the AVideo installation.

## Affected products

- WWBN AVideo version 29.0 and earlier

## Timeline

- 2026-08-19: disclosed
- 2026-09-03: advisory

## References

- [https://github.com/WWBN/AVideo/security/advisories/GHSA-59p8-6m2v-gcr5](https://github.com/WWBN/AVideo/security/advisories/GHSA-59p8-6m2v-gcr5)
- [https://www.vulncheck.com/advisories/wwbn-avideo-authentication-bypass-via-non-expiring-video-id-hash](https://www.vulncheck.com/advisories/wwbn-avideo-authentication-bypass-via-non-expiring-video-id-hash)

## Related threats

- [WWBN AVideo stored cross-site scripting in channel feed](https://junglewise.ai/threats/cve-2026-126810-wwbn-avideo-29-1-0-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo missing authorization in import and file operations](https://junglewise.ai/threats/cve-2026-126809-wwbn-avideo-through-29-7-1-contains-a-missing-authorization)
- [WWBN AVideo stored cross-site scripting in video download link](https://junglewise.ai/threats/cve-2026-126806-wwbn-avideo-14-3-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo incorrect authorization in encoder endpoints](https://junglewise.ai/threats/cve-2026-126805-wwbn-avideo-through-29-7-1-contains-an-incorrect-authorization)
- [WWBN AVideo path traversal in ADs plugin deleteImage.json.php](https://junglewise.ai/threats/cve-2026-126804-wwbn-avideo-12-4-through-29-7-1-contains-a-path-traversal)