The vulnerability stems from the Docker deployment artifacts that ship the administrator password as "password" and assign database credentials of avideo/avideo. The default credentials are automatically used to seed the admin account during installation, providing an obvious, trivial entry point for attackers. The weakness is a predictable default password (CWE‑1188) compounded by weak MD5 hashing, with no requirement for a password change on first login or any complexity enforcement. As a result, anyone who can reach the web interface of a newly deployed instance can obtain full administrative privileges, expose user data, modify content, and potentially execute code through file uploads or plugin management.

The affected application is WWBN AVideo up to and including version 25.0. The default Docker configuration files (docker-compose.yml and env.example) contain the hard‑coded credentials. No other versions prior to 26.0 are known to contain this issue.

The CVSS score of 8.1 indicates high severity. The EPSS score of less than 1% suggests a low probability of exploitation, yet the impact if exploited is substantial. Attackers can log in simply by using the default credentials exposed in the container environment; no additional techniques are required. The lack of compensating controls and the availability of direct administrative access make the risk significant enough to warrant immediate remediation.