The vulnerability lies in the LoginControl::verifyChallenge() function where a loose comparison (==) is used against session variables that may be unset. This allows an attacker who knows only the primary password to submit an empty request to verifyChallenge.json.php, causing the two‑factor PGP check to be bypassed and granting full authenticated access. The resulting impact can lead to unauthorized modification of user data, escalation of privileges, and potential disclosure of sensitive information.

The affected product is AVideo by WWBN. Any deployment that includes the code base identified by commit c3edcc274c389816d434acadac07ee78eaf330c1 contains the vulnerable logic. No specific release number is provided, but the vulnerability exists until the verifyChallenge method is corrected to use strict comparison.

The CVSS score of 8.6 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, implying no known mass exploitation at present. Attackers only need valid credentials and can trigger the bypass with an empty HTTP request, making the threat realistic and plausible in typical remote attack scenarios, especially where PGP two‑factor authentication is enabled.