CVE-2026-85154CWE-269privilege-escalation

CVE-2026-85154

Critical · published September 3, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
50.1
In the wild
Unconfirmed
What it is

WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a video_id_hash can replay it indefinitely to authenticate as the video owner with full privileges, and the credential remains valid even after the owner changes their password.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00642 · 50.1th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-09-03T17:06Z
References (3)
https://github.com/WWBN/AVideo/security/advisories/GHSA-59p8-6m2v-gcr5 · [email protected]https://www.vulncheck.com/advisories/wwbn-avideo-authentication-bypass-via-non-expiring-video-id-hash · [email protected]https://github.com/WWBN/AVideo/security/advisories/GHSA-59p8-6m2v-gcr5 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 11:22Z
    WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash
    cvelistv5