CVE-2026-92578CWE-287

CVE-2026-92578

High · published September 17, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
48.9
In the wild
Unconfirmed
What it is

WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credential through two independent code paths in loginFromRequest() and encryptPasswordVerify(). Attackers who obtain the stored users.password hash value can authenticate as any user by submitting the hash directly to login endpoints, completely bypassing password verification.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00617 · 48.9th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-09-17T02:18Z
References (3)
https://github.com/WWBN/AVideo/security/advisories/GHSA-fq38-jp6c-q4cx · [email protected]https://www.vulncheck.com/advisories/wwbn-avideo-through-29.0-authentication-bypass-via-stored-password-hash · [email protected]https://github.com/WWBN/AVideo/security/advisories/GHSA-fq38-jp6c-q4cx · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 21:46Z
    WWBN AVideo through 29.0 Authentication Bypass via Stored Password Hash
    cvelistv5