Executive brief
AVideo is a web-based video streaming and management platform. The vulnerability allows attackers with a valid user password to bypass email-based two-factor authentication (2FA) on new devices, enabling unauthorized account access without entering a confirmation code. This defeats a critical security control intended to protect accounts from password compromise.
Technical details
The vulnerability is an improper authentication bypass caused by a SQL result caching flaw in the sqlDAL layer (objects/mysql_dal.php). The readSql method caches all query results, including empty result sets, but the writeSql method never invalidates this cache. During the 2FA flow, a SELECT for login history is executed, then an INSERT creates a new history row, then the same SELECT is repeated—but the second SELECT returns the stale empty cached result instead of the newly inserted row. This causes getConfirmationCodeHash() to fail silently, send2FAEmail() returns false, and instead of terminating the session (the intended behavior), the login is allowed to proceed. The attack requires LoginControl to be enabled with enable2FA configured, and the attacker must possess a valid password. No patch is currently available.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master 2026-08-21), including release 29.0
Timeline
- 2026-08-24: disclosed: Security advisory published on GitHub
- 2026-09-08: advisory: Published to NVD