An unauthenticated web endpoint in the AVideo platform exposes the internal password hashing function, allowing any user to submit arbitrary passwords and receive their hashed forms. This creates a password‑hash oracle. If attackers also obtain hashed passwords from the database—through SQL injection, backups, or other leaks—they can compare the oracle output against the leaked hashes and recover the original passwords with relative ease. The weakness is compounded by the use of a weak, unsalted hash chain (md5+whirlpool+sha1), which accelerates offline cracking. Successful compromise of user credentials can lead to unauthorized access to user accounts and thereby to the underlying media assets and administrative functions.

The vulnerability affects the open‑source video platform produced by WWBN, known as AVideo, in all releases version 25.0 and earlier. These versions expose the /objects/encryptPass.json.php endpoint to unauthenticated requests.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score of less than 1% suggests that exploitation is currently unlikely to be widespread. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can exploit the flaw by simply sending HTTP requests to the vulnerable endpoint; however, meaningful damage occurs only when they also have access to the database hash store, which might be obtained via separate vulnerabilities such as SQL injection or data exfiltration. Once a hash is acquired from the database, the oracle can accelerate the cracking process dramatically, posing a significant risk to users’ confidentiality and integrity of credentials.