CVE-2026-86722: AVideo Authentication Bypass via SQL Cache Invalidation
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates. Attackers with a valid password can bypass email two-factor authentication on new devices because the confirmation code hash fails to generate from the stale cached empty result.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid password for an AVideo account. The issue affects attempts to sign in from a new device where email two-factor authentication would normally be required.
What security control can be bypassed?
The vulnerability allows bypass of email-based two-factor authentication. It does not indicate that an attacker can authenticate without first having a valid password.
How does the bypass occur?
AVideo's sqlDAL can cache an empty result set, and writeSql does not invalidate that cached result. As a result, the confirmation-code hash may not be generated, allowing the email two-factor check to be bypassed on a new device.
Which versions are affected?
The available information states that AVideo is affected through commit c3edcc274c389816d434acadac07ee78eaf330c1. No release-version range is provided.