The vulnerability resides in the MobileManager module of the AVideo platform. During OAuth completion, the service issues an HTTP redirect that contains the user's email and a stored password hash in the query string. The hash uses md5 over whirlpool and sha1, but it is the same value used for authentication. Because this value is exposed in the redirect URL, anyone who can capture the URL—for example, from server logs, referrer headers, or browser history—obtains a credential equivalent to the plain‑text password. An attacker can then use the platform’s login endpoint, which accepts a flag that bypasses password hashing, to authenticate directly with the leaked hash. This allows full account takeover, including privileged admin accounts. The weakness is a form of information disclosure linked to CWE-598.

The affected product is WWBN AVideo, an open source video hosting platform. Versions up to and including 29.0 contain the flaw. The issue resides specifically in the MobileManager oauth2.php script. The fix has already been committed (977cd6930a97571a26da4239e25c8096dd4ecbc1), so any deployment running version 29.0 or earlier is affected.

The CVSS score is 6.8, indicating a medium severity security flaw. No EPSS score is publicly available, and the vulnerability is not in the CISA KEV catalog. The attack vector typically requires the attacker to gather the redirect URL, which may be accomplished by inspecting server logs, intercepting traffic on a shared network, or tampering with lossless referrer data. Once the hash is captured, the attacker can perform a credential pass‑through attack by sending the hash value to the platform’s JSON login endpoint with the encodedPass flag, achieving full unauthorized access to the victim’s account. The impact is strong authentication bypass leading to potentially complete system compromise if privileged accounts are taken over.