CVE-2026-84483CWE-321

CVE-2026-84483

Medium · published September 2, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
37.9
In the wild
Unconfirmed
What it is

WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using the public site URL and current time. Attackers can forge authentication tokens by computing hash_hmac with the site's base URL as the key and submit arbitrary passwords to receive encrypted hashes, enabling offline precomputation attacks against stolen password databases.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00448 · 37.9th percentile
Weakness
CWE-321 · Use of Hard-coded Cryptographic Key
Published
2026-09-02T03:17Z
References (3)
https://github.com/WWBN/AVideo/security/advisories/GHSA-q92q-q2f7-v4fc · [email protected]https://www.vulncheck.com/advisories/wwbn-avideo-unauthenticated-password-hash-oracle-via-encryptpass-json-php · [email protected]https://github.com/WWBN/AVideo/security/advisories/GHSA-q92q-q2f7-v4fc · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 01 SEP 22:25Z
    WWBN AVideo Unauthenticated Password Hash Oracle via encryptPass.json.php
    cvelistv5