CVE-2026-85154: WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash
WWBN AVideo contains an authentication failure vulnerability where the videoidhash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a videoidhash can replay it indefinitely to authenticate as the video owner with full privileges, and the credential remains valid even after the owner changes their password.
Affected Software
Event History
Frequently Asked Questions
What must an attacker obtain to exploit this issue?
An attacker needs a valid video_id_hash credential for a video. That value can then be replayed as a bearer token to authenticate as the video owner.
What level of access does a compromised video_id_hash provide?
The credential grants full administrator session access to the account that owns the associated video. Exploitation requires no privileges or user interaction once the attacker has the hash.
Will changing the affected account's password invalidate a stolen credential?
No. The video_id_hash remains valid after the owner changes their password, so password reset alone does not remove an attacker's access.
How long can a stolen video_id_hash be used?
It can be replayed indefinitely because the credential is non-expiring and non-revocable.