Is CVE-2026-92913 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92913 being exploited in the wild.

How severe is CVE-2026-92913?

High severity, with a CVSS score of 7.4, published 17 September 2026.

Which products and versions are affected?

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1.

Is there a fix for CVE-2026-92913?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-92913 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-92913?

Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92913: AVideo weak PRNG in activation code generation

CVE-2026-92913 · Severity: high · CVSS 7.4 · Published 2026-09-17

AVideo is a video hosting and streaming platform. The system uses weak random code generation for account activation and login pairing, allowing unauthenticated attackers to guess valid codes and gain account access with a one-year credential. With only ~2^25 possible code values and knowledge of server microtime, attackers can bypass authentication and access private user data, emails, and account playlists.

Technologies: WWBN AVideo. Vendors: WWBN.

Quick answers

Is CVE-2026-92913 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92913 being exploited in the wild.
How severe is CVE-2026-92913?: High severity, with a CVSS score of 7.4, published 17 September 2026.
Which products and versions are affected?: WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1.
Is there a fix for CVE-2026-92913?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-92913 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-92913?: Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the getRandomCode() function in objects/functions.php, which generates account activation codes using PHP's uniqid() (which encodes server time and microseconds) with only a single non-CSPRNG rand() character for padding. This reduces the effective code space to approximately 2^25 values for a known generation second, far below cryptographic strength. The unauthenticated endpoint plugin/API/set.json.php?APIName=login_code acts as an oracle disclosing the server's exact microtime. An attacker can guess valid, unexpired codes (10-minute window) and redeem them at plugin/API/get.json.php?APIName=login_code to obtain the target account's email and a User::getUserHash() credential valid for one year as a password substitute. Attack requires network access to the AVideo instance; no authentication is required. Mitigation exists only as a per-IP rate limit (5 attempts per 300 seconds), which can be worked around across multiple IPs. No patch is currently available.

Affected products

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1

Timeline

2026-09-17: disclosed
2026-09-02: advisory: GitHub Security Advisory GHSA-v65f-hc7x-wj62 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.