CVE-2026-59808: AVideo Authentication Bypass via Unkeyed Video Hash Disclosure
AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId() returns videoidhash credentials for any video by encoderqueueid without ownership verification, and useVideoHashOrLogin() converts this hash into passwordless login as the video owner. Attackers with upload permission can retrieve an administrator's videoidhash by omitting the videosid parameter, then use that hash in an unauthenticated request to gain administrative session access and modify system configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AVideoto a version that resolves this vulnerability.Patch 9c39d8c8 - Compensating control
Restrict video upload/creation permissions so that untrusted users cannot upload videos, since attackers with upload permission can retrieve an administrator's video_id_hash by omitting the videos_id parameter and use that hash for unauthenticated admin session access.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an account with upload permission. The attack can be performed over the network without user interaction and can lead to administrative session access if an administrator's video hash is obtained.
What access does the attacker need before exploitation?
The attacker must have upload permission, which corresponds to the low-privileges requirement in the severity vector. No administrator credentials or user interaction are required.
What is the impact after successful exploitation?
The disclosed video_id_hash can be used for passwordless login as the video owner. If the hash belongs to an administrator, the attacker can obtain an administrative session and modify system configuration.
How does the attacker obtain the credential-like video hash?
The vulnerable deduplicateByEncoderQueueId() behavior returns a video_id_hash for a video identified by encoder_queue_id without verifying ownership. The described attack obtains an administrator's hash by omitting the videos_id parameter.