CVE-2026-92578NVD

Vulnerability Summary

WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credential through two independent code paths in loginFromRequest() and encryptPasswordVerify(). Attackers who obtain the stored users.password hash value can authenticate as any user by submitting the hash directly to login endpoints, completely bypassing password verification.

Severity Level

HIGH(8.1)

Published Date

Sep 16, 2026

Last Modified

Sep 17, 2026

Exploitation Status

No confirmed exploitation yet

EPSS Score (30-Day)

0.33%Probability

Root Weakness (CWE)

CWE-287: Improper Authentication ↗

When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.

CVSS v4.0 Base Metrics — Score 9.2 (CRITICAL)

Attack VectorNetwork

Attack ComplexityLow

Attack RequirementsPresent

Privileges RequiredNone

User InteractionNone

Confidentiality (Vulnerable System)High

Integrity (Vulnerable System)High

Availability (Vulnerable System)High

Confidentiality (Subsequent System)None

Integrity (Subsequent System)None

Availability (Subsequent System)None

CVSS v3.1 Base Metrics — Score 8.1 (HIGH)

Attack VectorNetwork

Attack ComplexityHigh

Privileges RequiredNone

User InteractionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

Affected & Patched Versions

Affected Versions

WWBN AVideo <= 29.0

Patched Versions

WWBN AVideo 29.0

📧Email Delivery — Threat intel straight to your inbox.

♾️Unlimited Vendors — Track your entire stack.

🚨All New CVEs — Be the first to know.

⚙️Custom EPSS — Filter noise, focus on risk.

💬Webhooks — Slack & Teams integration.

🚫Ad-Free — Uninterrupted experience.