CVE-2026-92914: AVideo LoginControl PGP Second Factor Authentication Bypass
AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against an uninitialized session variable. Attackers with a victim's password can bypass the second factor by sending a parameter-less GET request to verifyChallenge.json.php, which evaluates null == null and marks authentication complete.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs the victim's password. They can then send a parameter-less GET request to verifyChallenge.json.php to bypass the PGP second-factor check.
Which second-factor configuration is affected?
The issue affects the PGP second-factor verification in AVideo LoginControl. The vulnerable comparison can treat an uninitialized session value and a missing challenge response as equal.
How does the bypass complete authentication?
A parameter-less request causes the verification to evaluate null == null. The application then marks authentication as complete without a valid PGP challenge response.