CVE-2026-126805: WWBN AVideo through 29.7.1 Privilege Escalation via Encoder video_id_hash
WWBN AVideo through 29.7.1 contains an incorrect authorization vulnerability that allows delegated Videos Admin users to obtain videoidhash values bound to any video owner via encoder endpoints like aVideoEncoderStatus.json.php. Attackers can request the hash for an administrator-owned video and replay it through useVideoHashOrLogin() for password-less login, gaining plugin upload, configuration, and user management access.
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated user with delegated Videos Admin privileges can exploit it. The attacker can obtain a video_id_hash associated with another video owner, including an administrator, through encoder endpoints.
What access can an attacker gain after exploiting it?
The attacker can replay the obtained hash through useVideoHashOrLogin() for password-less login as the affected video owner. If the hash belongs to an administrator-owned video, this provides access to plugin uploads, configuration management, and user management.
Is a default installation affected?
The available information does not establish whether delegated Videos Admin privileges are assigned by default. Exploitation requires an account that already has those delegated privileges.
How can I determine whether my deployment is in scope?
Deployments running WWBN AVideo version 29.7.1 or earlier are in scope according to the affected-version information. Review whether any delegated Videos Admin accounts exist and whether they can access encoder endpoints such as aVideoEncoderStatus.json.php.