CVE-2026-85154

9.3 criticalEPSS 0.6%

Critical (9.3). EPSS 0.6% chance of exploitation in the next 30 days.

WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a video_id_hash can replay it indefinitely to authenticate as the video owner with full privileges, and the credential remains valid even after the owner changes their password.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
CWE: CWE-269
Published: 2026-09-03
Modified: 2026-09-08
Record from: the NVD, synced 2026-10-19

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-59p8-6m2v-gcr5
https://www.vulncheck.com/advisories/wwbn-avideo-authentication-bypass-via-non-expiring-video-id-hash
https://github.com/WWBN/AVideo/security/advisories/GHSA-59p8-6m2v-gcr5

Check your stack JSON