Quick answers
- Is CVE-2026-92914 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-92914 being exploited in the wild.
- How severe is CVE-2026-92914?
- High severity, with a CVSS score of 8.1, published 17 September 2026.
- Which products and versions are affected?
- WWBN AVideo 29.0 and earlier.
- Is there a fix for CVE-2026-92914?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-92914 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-92914?
- Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an authentication bypass in the verifyChallenge() function (CWE-287: Improper Authentication), which uses loose equality (==) to compare a challenge response against an uninitialized session variable. When a user never loads the challenge HTML page, the session variable remains unset and evaluates to null; a parameter-less GET request to verifyChallenge.json.php also results in a null response parameter. Since null == null returns true, the second factor is marked complete without any valid challenge response. The endpoint requires only User::isLogged() authentication, so an attacker with the victim's password (network-accessible over HTTP GET) can invoke this with no user interaction. No patch is currently available; the suggested fix involves using strict equality (===) or hash_equals(), initializing variables properly, and validating that both values are non-empty before comparison.
Affected products
- WWBN AVideo 29.0 and earlier
Timeline
- 2026-09-17: disclosed: CVE-2026-92914 published