UpHeron
All vulnerabilities

Servers and applications

CVE-2026-126805

WWBN AVideo through 29.7.1 Privilege Escalation via Encoder video_id_hash

Severity
High 8.6
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Weakness
Incorrect authorization (CWE-863)
Attack
Over the network · Needs an administrator account · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Sources
CVE Program

Description

WWBN AVideo through 29.7.1 contains an incorrect authorization vulnerability that allows delegated Videos Admin users to obtain video_id_hash values bound to any video owner via encoder endpoints like aVideoEncoderStatus.json.php. Attackers can request the hash for an administrator-owned video and replay it through useVideoHashOrLogin() for password-less login, gaining plugin upload, configuration, and user management access.

From the CVE Program.

Affected software

SoftwareAffected versions
AVideoServers and applications · cna:wwbn|avideo
  • Every version up to 29.7.1

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126805