# CVE-2026-92913: AVideo weak PRNG in activation code generation

Source: https://junglewise.ai/threats/cve-2026-92913-avideo-weak-prng-in-activation-code-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92913 · Severity: high · CVSS 7.4 · Published 2026-09-17

AVideo is a video hosting and streaming platform. The system uses weak random code generation for account activation and login pairing, allowing unauthenticated attackers to guess valid codes and gain account access with a one-year credential. With only ~2^25 possible code values and knowledge of server microtime, attackers can bypass authentication and access private user data, emails, and account playlists.

Technologies: [WWBN AVideo](https://junglewise.ai/threats/technologies/avideo). Vendors: [WWBN](https://junglewise.ai/threats/vendors/wwbn).

## Quick answers

**Is CVE-2026-92913 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92913 being exploited in the wild.

**How severe is CVE-2026-92913?** High severity, with a CVSS score of 7.4, published 17 September 2026.

**Which products and versions are affected?** WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1.

**Is there a fix for CVE-2026-92913?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92913 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-92913?** Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the getRandomCode() function in objects/functions.php, which generates account activation codes using PHP's uniqid() (which encodes server time and microseconds) with only a single non-CSPRNG rand() character for padding. This reduces the effective code space to approximately 2^25 values for a known generation second, far below cryptographic strength. The unauthenticated endpoint plugin/API/set.json.php?APIName=login_code acts as an oracle disclosing the server's exact microtime. An attacker can guess valid, unexpired codes (10-minute window) and redeem them at plugin/API/get.json.php?APIName=login_code to obtain the target account's email and a User::getUserHash() credential valid for one year as a password substitute. Attack requires network access to the AVideo instance; no authentication is required. Mitigation exists only as a per-IP rate limit (5 attempts per 300 seconds), which can be worked around across multiple IPs. No patch is currently available.

## Affected products

- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1

## Timeline

- 2026-09-17: disclosed
- 2026-09-02: advisory: GitHub Security Advisory GHSA-v65f-hc7x-wj62 published

## References

- [https://github.com/WWBN/AVideo/security/advisories/GHSA-v65f-hc7x-wj62](https://github.com/WWBN/AVideo/security/advisories/GHSA-v65f-hc7x-wj62)
- [https://www.vulncheck.com/advisories/avideo-weak-prng-activation-code-authentication-bypass](https://www.vulncheck.com/advisories/avideo-weak-prng-activation-code-authentication-bypass)

## Related threats

- [WWBN AVideo stored cross-site scripting in channel feed](https://junglewise.ai/threats/cve-2026-126810-wwbn-avideo-29-1-0-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo missing authorization in import and file operations](https://junglewise.ai/threats/cve-2026-126809-wwbn-avideo-through-29-7-1-contains-a-missing-authorization)
- [WWBN AVideo stored cross-site scripting in video download link](https://junglewise.ai/threats/cve-2026-126806-wwbn-avideo-14-3-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo incorrect authorization in encoder endpoints](https://junglewise.ai/threats/cve-2026-126805-wwbn-avideo-through-29-7-1-contains-an-incorrect-authorization)
- [WWBN AVideo path traversal in ADs plugin deleteImage.json.php](https://junglewise.ai/threats/cve-2026-126804-wwbn-avideo-12-4-through-29-7-1-contains-a-path-traversal)