The LoginControl plugin in WWBN AVideo uses 512‑bit RSA keys for its PGP two‑factor authentication. Those key sizes are factorizable with publicly known algorithms, allowing an attacker who obtains a user’s public key to compute the private key on commodity hardware in a matter of hours. With the private key, the attacker can decrypt any challenge presented by the system and complete the login without the second factor. In addition, two API endpoints that generate keys and encrypt messages lack authentication checks, enabling anonymous users to request CPU‑intensive key creation and exploit this weakness further.

Versions of AVideo 26.0 and earlier that include the LoginControl plugin are affected. Users running these releases are at risk when the plugin is enabled, regardless of whether the vulnerable endpoints are exposed to the network.

The score of 7.4 indicates a high severity level, yet the likelihood of exploitation is low, estimated below 1 percent. Attacker preparation requires obtaining a public key, performing factorization, and decrypting the challenge; all tasks can be completed in a few hours with standard hardware. Once the loophole is passed, an attacker gains full session control, potentially exposing sensitive video content. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet, but the impact warrants urgent attention.