Executive brief
WWBN AVideo is a video streaming platform that manages user accounts and authentication. The system contains a critical flaw where attackers who obtain a user's stored password hash can use that hash directly as a login credential, completely bypassing password verification. This means any disclosure of the password hash database—from backups, SQL injection, or improper access controls—directly leads to account compromise without requiring password cracking.
Technical details
The vulnerability is an authentication bypass in WWBN AVideo through version 29.0 caused by two independent flawed code paths in loginFromRequest() and encryptPasswordVerify(). In loginFromRequest(), the code retries authentication with the opposite encodedPass flag value, treating the stored hash as a valid plaintext credential. In encryptPasswordVerify(), a legacy code path performs a direct string comparison between the submitted password and the stored hash, returning true if they match. Both paths are reachable without special privileges—loginFromRequest() is called by the default-active Live plugin at include time, making it accessible via any URL accepting user and pass parameters. An unauthenticated attacker who obtains the stored users.password hash value can submit it directly to any login endpoint to authenticate as that user with no password cracking required. No patch is currently available.
Affected products
- WWBN AVideo through 29.0
Timeline
- 2026-09-16: disclosed
- other: GitHub Security Advisory GHSA-fq38-jp6c-q4cx published; no patched version available as of advisory date