AVideo contains an authentication bypass where the deduplicateByEncoderQueueId() function returns a video_id_hash that can be used as credentials for any video. The useVideoHashOrLogin() method turns that hash into a passwordless session belonging to the video owner. Attackers with upload permission can retrieve an administrator’s hash and log in without credentials, enabling configuration changes or intrusion into other sensitive data.

The affected product is AVideo from WWBN. Versions that include or are older than the commit 9c39d8c8 are impacted. No specific numeric version range is listed beyond the commit reference, so any installation that has not applied the patch is vulnerable.

The CVSS score of 8.7 indicates a high‑severity flaw. EPSS is not available, but the lack of a KEV listing suggests exploitation has not yet been observed widely. The attack path only requires the ability to upload a video, a permission commonly granted, and does not need privileged credentials at first. Once the video_id_hash is obtained, the unauthenticated useVideoHashOrLogin() endpoint can be called to log in as an administrator. This grants full system control and the ability to modify configuration, escalating from low privilege to full administrative access.