{"id":"CVE-2026-86722","title":"AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates","summary":"AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates. Attackers with a valid password can bypass email two-fa…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-287"],"vendor":"WWBN","product":"AVideo","affected":["AVideo <= c3edcc274c389816d434acadac07ee78eaf330c1"],"published":"2026-09-08","updated":"2026-09-10","sourceUpdated":"2026-09-10T14:17:09.707","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86722","references":[{"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-wmhg-p72j-72gf","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/avideo-authentication-bypass-via-sql-cache-invalidation","label":"disclosure@vulncheck.com"},{"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-wmhg-p72j-72gf","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-10T13:50:56.034109Z"},"epss":0.00269,"epssPercentile":0.19274,"ingestedAt":"2026-09-08T15:33:26.987Z","slug":"CVE-2026-86722","body":"## Overview\n\nAVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates. Attackers with a valid password can bypass email two-factor authentication on new devices because the confirmation code hash fails to generate from the stale cached empty result.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":57,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":202152,"id":"CVE-2026-86722","ts":1789400064037,"field":"exploit_available","old":"false","new":"true"},{"seq":200879,"id":"CVE-2026-86722","ts":1789397617904,"field":"exploit_available","old":"true","new":"false"},{"seq":199572,"id":"CVE-2026-86722","ts":1789395541079,"field":"exploit_available","old":"false","new":"true"},{"seq":198817,"id":"CVE-2026-86722","ts":1789392245832,"field":"exploit_available","old":"true","new":"false"},{"seq":197150,"id":"CVE-2026-86722","ts":1789384295190,"field":"exploit_available","old":"false","new":"true"},{"seq":196424,"id":"CVE-2026-86722","ts":1789383757494,"field":"exploit_available","old":"true","new":"false"},{"seq":195328,"id":"CVE-2026-86722","ts":1789380575896,"field":"exploit_available","old":"false","new":"true"},{"seq":194279,"id":"CVE-2026-86722","ts":1789378784522,"field":"exploit_available","old":"true","new":"false"},{"seq":193066,"id":"CVE-2026-86722","ts":1789376519065,"field":"exploit_available","old":"false","new":"true"},{"seq":191853,"id":"CVE-2026-86722","ts":1789373632730,"field":"exploit_available","old":"true","new":"false"},{"seq":190638,"id":"CVE-2026-86722","ts":1789369485370,"field":"exploit_available","old":"false","new":"true"},{"seq":189425,"id":"CVE-2026-86722","ts":1789368444399,"field":"exploit_available","old":"true","new":"false"},{"seq":188208,"id":"CVE-2026-86722","ts":1789365235036,"field":"exploit_available","old":"false","new":"true"},{"seq":186995,"id":"CVE-2026-86722","ts":1789363472754,"field":"exploit_available","old":"true","new":"false"},{"seq":185781,"id":"CVE-2026-86722","ts":1789361233670,"field":"exploit_available","old":"false","new":"true"},{"seq":184568,"id":"CVE-2026-86722","ts":1789358365374,"field":"exploit_available","old":"true","new":"false"},{"seq":182818,"id":"CVE-2026-86722","ts":1789354321277,"field":"exploit_available","old":"false","new":"true"},{"seq":181611,"id":"CVE-2026-86722","ts":1789353319213,"field":"exploit_available","old":"true","new":"false"},{"seq":180404,"id":"CVE-2026-86722","ts":1789350286247,"field":"exploit_available","old":"false","new":"true"},{"seq":179197,"id":"CVE-2026-86722","ts":1789348294393,"field":"exploit_available","old":"true","new":"false"},{"seq":177990,"id":"CVE-2026-86722","ts":1789346373839,"field":"exploit_available","old":"false","new":"true"},{"seq":176783,"id":"CVE-2026-86722","ts":1789343185982,"field":"exploit_available","old":"true","new":"false"},{"seq":174900,"id":"CVE-2026-86722","ts":1789334878569,"field":"exploit_available","old":"false","new":"true"},{"seq":173695,"id":"CVE-2026-86722","ts":1789333702277,"field":"exploit_available","old":"true","new":"false"},{"seq":172509,"id":"CVE-2026-86722","ts":1789331094534,"field":"exploit_available","old":"false","new":"true"},{"seq":171323,"id":"CVE-2026-86722","ts":1789328782357,"field":"exploit_available","old":"true","new":"false"},{"seq":170118,"id":"CVE-2026-86722","ts":1789327198622,"field":"exploit_available","old":"false","new":"true"},{"seq":168913,"id":"CVE-2026-86722","ts":1789323841744,"field":"exploit_available","old":"true","new":"false"},{"seq":167708,"id":"CVE-2026-86722","ts":1789319704303,"field":"exploit_available","old":"false","new":"true"},{"seq":166503,"id":"CVE-2026-86722","ts":1789318777649,"field":"exploit_available","old":"true","new":"false"},{"seq":165298,"id":"CVE-2026-86722","ts":1789315807700,"field":"exploit_available","old":"false","new":"true"},{"seq":164093,"id":"CVE-2026-86722","ts":1789313635722,"field":"exploit_available","old":"true","new":"false"},{"seq":162888,"id":"CVE-2026-86722","ts":1789311905363,"field":"exploit_available","old":"false","new":"true"},{"seq":161683,"id":"CVE-2026-86722","ts":1789308734648,"field":"exploit_available","old":"true","new":"false"},{"seq":159796,"id":"CVE-2026-86722","ts":1789300471999,"field":"exploit_available","old":"false","new":"true"},{"seq":156785,"id":"CVE-2026-86722","ts":1789294757208,"field":"exploit_available","old":"true","new":"false"},{"seq":155580,"id":"CVE-2026-86722","ts":1789292969398,"field":"exploit_available","old":"false","new":"true"},{"seq":154375,"id":"CVE-2026-86722","ts":1789289799589,"field":"exploit_available","old":"true","new":"false"},{"seq":151626,"id":"CVE-2026-86722","ts":1789277631262,"field":"exploit_available","old":"false","new":"true"},{"seq":150587,"id":"CVE-2026-86722","ts":1789276255555,"field":"exploit_available","old":"true","new":"false"},{"seq":149554,"id":"CVE-2026-86722","ts":1789273826192,"field":"exploit_available","old":"false","new":"true"},{"seq":148521,"id":"CVE-2026-86722","ts":1789271351066,"field":"exploit_available","old":"true","new":"false"},{"seq":146552,"id":"CVE-2026-86722","ts":1789269400660,"field":"exploit_available","old":"false","new":"true"},{"seq":145357,"id":"CVE-2026-86722","ts":1789266341726,"field":"exploit_available","old":"true","new":"false"},{"seq":144261,"id":"CVE-2026-86722","ts":1789262618127,"field":"exploit_available","old":"false","new":"true"},{"seq":143165,"id":"CVE-2026-86722","ts":1789261535023,"field":"exploit_available","old":"true","new":"false"},{"seq":141996,"id":"CVE-2026-86722","ts":1789258838735,"field":"exploit_available","old":"false","new":"true"},{"seq":140837,"id":"CVE-2026-86722","ts":1789256728562,"field":"exploit_available","old":"true","new":"false"},{"seq":139639,"id":"CVE-2026-86722","ts":1789254833514,"field":"exploit_available","old":"false","new":"true"},{"seq":138441,"id":"CVE-2026-86722","ts":1789251935653,"field":"exploit_available","old":"true","new":"false"}]}