CVE-2026-86723: AVideo LoginControl PGP Authentication Bypass via verifyChallenge
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability in LoginControl::verifyChallenge() that uses loose comparison (==) instead of strict comparison (===) against unset session values. Attackers with only a password can submit an empty request to verifyChallenge.json.php to bypass PGP two-factor authentication and gain full authenticated access.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs a valid account password. They can then send an empty request to verifyChallenge.json.php to bypass the PGP two-factor authentication check.
Is this a pre-authentication compromise?
No. The issue does not let an unauthenticated attacker log in without credentials; it bypasses the PGP second factor after the attacker has supplied a password.
What access is obtained after a successful bypass?
A successful exploit grants full authenticated access for the account whose password was used.
Which deployments are affected?
AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1 are affected. The described vulnerable condition is in LoginControl::verifyChallenge() and applies where PGP two-factor authentication is used.