WWBN AVideo exposes an unauthenticated password hash oracle via the encryptPass.json.php endpoint, allowing attackers to compute valid HMAC tokens using the site’s public URL and the current time. By forging these tokens, attackers can submit arbitrary passwords to receive encrypted hashes, which can then be used in offline precomputation attacks against stolen password databases. The vulnerability effectively bypasses authentication and facilitates credential compromise without initial login credentials.

The flaw exists in WWBN AVideo versions up to commit 9c39d8c8. Any instance of the application that has not yet applied the fix for this commit is affected.

The CVSS score of 6.9 indicates a moderate severity. The attack surface is a publicly accessible endpoint requiring no prior authentication; the exploit uses the site’s base URL and current time as inputs to generate the token. Although the EPSS score is not available, the vulnerability is not listed in the CISA KEV catalog, suggesting it may not have widespread exploitation yet, but the potential to steal and precompute password hashes remains a significant risk to confidentiality and authentication integrity.