---
id: CVE-2026-92578
title: >-
  WWBN AVideo through 29.0 contains an authentication bypass vulnerability where
  the stored password hash is accepted as a valid login credential through two
  independent code paths in loginFromRequest() and encryptPasswordVerify()
summary: >-
  WWBN AVideo through 29.0 contains an authentication bypass vulnerability where
  the stored password hash is accepted as a valid login credential through two
  independent code paths in loginFromRequest() and encryptPasswordVerify().
  Attacke…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-287
vendor: WWBN
product: AVideo
affected:
  - AVideo <= 29.0
published: '2026-09-16'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T15:16:58.247'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92578'
references:
  - url: 'https://github.com/WWBN/AVideo/security/advisories/GHSA-fq38-jp6c-q4cx'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/wwbn-avideo-through-29.0-authentication-bypass-via-stored-password-hash
    label: disclosure@vulncheck.com
  - url: 'https://github.com/WWBN/AVideo/security/advisories/GHSA-fq38-jp6c-q4cx'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-17T14:52:36.172760Z'
ingestedAt: '2026-09-16T22:06:50.933Z'
epss: 0.00332
epssPercentile: 0.26543
---

## Overview

WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credential through two independent code paths in loginFromRequest() and encryptPasswordVerify(). Attackers who obtain the stored users.password hash value can authenticate as any user by submitting the hash directly to login endpoints, completely bypassing password verification.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.