Executive brief
AVideo LoginControl is a plugin that manages user authentication and optional PGP-based second-factor verification. An attacker who has stolen a user's password can bypass the second-factor protection entirely by making a simple request with no parameters, allowing them to take over accounts even when PGP two-factor authentication is enabled. This means the second-factor protection provides no real security against password theft.
Technical details
The vulnerability is an authentication bypass in the verifyChallenge() function (CWE-287: Improper Authentication), which uses loose equality (==) to compare a challenge response against an uninitialized session variable. When a user never loads the challenge HTML page, the session variable remains unset and evaluates to null; a parameter-less GET request to verifyChallenge.json.php also results in a null response parameter. Since null == null returns true, the second factor is marked complete without any valid challenge response. The endpoint requires only User::isLogged() authentication, so an attacker with the victim's password (network-accessible over HTTP GET) can invoke this with no user interaction. No patch is currently available; the suggested fix involves using strict equality (===) or hash_equals(), initializing variables properly, and validating that both values are non-empty before comparison.
Affected products
- WWBN AVideo 29.0 and earlier
Timeline
- 2026-09-17: disclosed: CVE-2026-92914 published