Cyber & AI intelligence
Wasteland.
Briefs indexed2382
Issues26
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-85154 2026-09-03

CVE-2026-85154: WWBN AVideo Video Hash Doubles as a Permanent Account Credential

"A critical authentication flaw in WWBN AVideo lets anyone holding a `video_id_hash` authenticate as the video's owner; indefinitely, and even after that account's password is changed."

A critical authentication flaw in WWBN AVideo lets anyone holding a video_id_hash authenticate as the video's owner; indefinitely, and even after that account's password is changed.

What Is It

CVE-2026-85154 is an authentication failure in WWBN AVideo. The video_id_hash value functions as a bearer token, but it never expires and cannot be revoked. Anyone who obtains that hash can replay it to establish a full session as the video owner, inheriting whatever privileges that account holds; administrator rights included, where the owner is an administrator.

The vulnerability is tracked as CWE-269 (Improper Privilege Management) and carries a CVSS 3.1 base score of 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A secondary CVSS 4.0 assessment scores it 9.3 (Critical). It was disclosed by VulnCheck and published on 2026-09-03.

Why It Matters

The scoring reflects the worst-case exploitation profile: network-reachable, low attack complexity, no privileges, and no user interaction required, with high confidentiality, integrity, and availability impact. There is no separate credential to phish or crack; possession of the hash is what the application treats as proof of identity.

What makes this worse than a typical credential leak is that the normal containment playbook does not work. The record explicitly states the credential remains valid after the owner changes their password, and that it is non-revocable. An operator who suspects compromise has no in-product way to invalidate a leaked hash, which suggests that any prior exposure of a video_id_hash, in logs, referrers, shared links, or proxies; should be treated as a credential that is still live until the vendor ships a fix that invalidates it. Where the exposed hash belongs to a video owned by an administrator, that likely amounts to a standing administrator credential.

What's Vulnerable

No CPE match strings were present in the NVD record at time of publication.

Patch Status

The NVD record has a status of Received and lists no patch version, mitigation, or fix guidance. As of publication, CVE-2026-85154 does not appear in the CISA Known Exploited Vulnerabilities catalog, so there is no KEV-confirmed active exploitation and no KEV-mandated required action or remediation due date. Operators should consult the vendor's GitHub security advisory below for current fix availability.

Sources