CVE-2026-86187: WWBN AVideo Weak PRNG Password Generation via External Login
WWBN AVideo generates passwords for external-login accounts using rand() instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
External-login accounts are the affected population. Exploitation also requires an attacker to obtain password hashes for those accounts.
What access does an attacker need to exploit the weakness?
An attacker needs access to the affected password hashes. They can then conduct an offline brute-force attack; the weak 31-bit rand() output and unsalted MD5 hashing allow plaintext passwords to be recovered in minutes.
Is exploitation possible remotely without prior access?
The listed attack vector is network-based, but the described attack depends on obtaining password hashes first. The provided information does not identify a method for acquiring those hashes.