Executive brief
WWBN AVideo is a video content management platform that supports social login (Google, Facebook, LinkedIn). When users log in through these external providers, AVideo automatically creates accounts with passwords generated using PHP's rand() function instead of a cryptographic generator. If a database is compromised or password hashes are leaked, attackers can recover plaintext passwords for these accounts in minutes through offline brute-force attacks, potentially enabling account takeover and credential reuse across other services.
Technical details
AVideo uses PHP's rand() (Mersenne Twister) to generate passwords for accounts created via external-login flows (HybridAuth, LoginWordPress plugin, MobileManager plugin), producing only 31-bit integers. The vulnerability is compounded by unsalted MD5-based password hashing (md5(hash("whirlpool", sha1($password)))), which offers no work factor. With a search space of 2^31 (~2.1 billion), attackers who obtain password hashes—via database breach, SQL injection, or backup disclosure—can perform offline brute-force recovery in 10–50 minutes using commodity hardware. The recovered credentials are immediately usable because the accounts have emailVerified=1 and username set to email address. This is an offline attack; online login brute-force is not feasible. The patch uses random_bytes(32) for cryptographic generation, expanding the keyspace to 2^256.
Affected products
- WWBN AVideo 29.0 and earlier
Timeline
- 2026-08-21: disclosed
- 2026-09-05: advisory