Executive brief
AVideo is a video hosting and streaming platform. The system uses weak random code generation for account activation and login pairing, allowing unauthenticated attackers to guess valid codes and gain account access with a one-year credential. With only ~2^25 possible code values and knowledge of server microtime, attackers can bypass authentication and access private user data, emails, and account playlists.
Technical details
The vulnerability exists in the getRandomCode() function in objects/functions.php, which generates account activation codes using PHP's uniqid() (which encodes server time and microseconds) with only a single non-CSPRNG rand() character for padding. This reduces the effective code space to approximately 2^25 values for a known generation second, far below cryptographic strength. The unauthenticated endpoint plugin/API/set.json.php?APIName=login_code acts as an oracle disclosing the server's exact microtime. An attacker can guess valid, unexpired codes (10-minute window) and redeem them at plugin/API/get.json.php?APIName=login_code to obtain the target account's email and a User::getUserHash() credential valid for one year as a password substitute. Attack requires network access to the AVideo instance; no authentication is required. Mitigation exists only as a per-IP rate limit (5 attempts per 300 seconds), which can be worked around across multiple IPs. No patch is currently available.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-09-17: disclosed
- 2026-09-02: advisory: GitHub Security Advisory GHSA-v65f-hc7x-wj62 published