This vulnerability allows an attacker with a valid user password to bypass the email–based two‑factor authentication in AVideo. By exploiting a flaw in the SQL cache invalidation logic, the system serves stale cached empty result sets, causing the confirmation code hash to be omitted during login on new devices. Consequently, the attacker can log into the target account without completing the 2FA challenge, granting unauthorized access to the user’s data and administrative functions.

The affected product is AVideo from WWBN. The advisory references commit c3edcc274c389816d434acadac07ee78eaf330c1 where the flaw exists, but no explicit version range is supplied; therefore any deployment built from this commit or later without the applied fix may be vulnerable.

The CVSS score of 8.6 indicates high severity. EPSS is not available, so the current exploit probability is unknown. The vulnerability is not listed in the CISA KEV catalog. An attacker would need a valid user password and must attempt to log in from a new device; the exploitation is remote and occurs over the network during normal authentication traffic.