CVE-2026-84483: WWBN AVideo Unauthenticated Password Hash Oracle via encryptPass.json.php
WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using the public site URL and current time. Attackers can forge authentication tokens by computing hashhmac with the site's base URL as the key and submit arbitrary passwords to receive encrypted hashes, enabling offline precomputation attacks against stolen password databases.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WWBN AVideoto a version that resolves this vulnerability.Patch commit 9c39d8c8 - Compensating control
Since the issue allows unauthenticated attackers to compute valid HMAC tokens, restrict external access to encryptPass.json.php (e.g., via WAF/ACL rules allowing only authorized users/IPs) while applying the commit fix.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs network access to the affected AVideo instance but does not need an account, privileges, or user interaction. They can derive valid HMAC tokens from the public site URL and the current time.
Who faces the most significant risk from this vulnerability?
The primary risk is to deployments where an attacker has obtained a password database. The exposed endpoint can be used to submit arbitrary passwords and obtain encrypted hashes, supporting offline precomputation attacks against stolen password data.
What security property is lost if the endpoint is reachable?
Unauthenticated callers can compute valid authentication tokens and use the endpoint as a password-hash oracle. The reported impact is limited to confidentiality; no integrity or availability impact is identified.