A critical authentication flaw in WWBN AVideo lets anyone holding a video_id_hash authenticate as the video's owner; indefinitely, and even after that account's password is changed.
What Is It
CVE-2026-85154 is an authentication failure in WWBN AVideo. The video_id_hash value functions as a bearer token, but it never expires and cannot be revoked. Anyone who obtains that hash can replay it to establish a full session as the video owner, inheriting whatever privileges that account holds; administrator rights included, where the owner is an administrator.
The vulnerability is tracked as CWE-269 (Improper Privilege Management) and carries a CVSS 3.1 base score of 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A secondary CVSS 4.0 assessment scores it 9.3 (Critical). It was disclosed by VulnCheck and published on 2026-09-03.
Why It Matters
The scoring reflects the worst-case exploitation profile: network-reachable, low attack complexity, no privileges, and no user interaction required, with high confidentiality, integrity, and availability impact. There is no separate credential to phish or crack; possession of the hash is what the application treats as proof of identity.
What makes this worse than a typical credential leak is that the normal containment playbook does not work. The record explicitly states the credential remains valid after the owner changes their password, and that it is non-revocable. An operator who suspects compromise has no in-product way to invalidate a leaked hash, which suggests that any prior exposure of a video_id_hash, in logs, referrers, shared links, or proxies; should be treated as a credential that is still live until the vendor ships a fix that invalidates it. Where the exposed hash belongs to a video owned by an administrator, that likely amounts to a standing administrator credential.
What's Vulnerable
- Vendor: WWBN
- Product: AVideo
- Affected versions: all versions up to and including 29.0 (default status for other versions: unaffected)
No CPE match strings were present in the NVD record at time of publication.
Patch Status
The NVD record has a status of Received and lists no patch version, mitigation, or fix guidance. As of publication, CVE-2026-85154 does not appear in the CISA Known Exploited Vulnerabilities catalog, so there is no KEV-confirmed active exploitation and no KEV-mandated required action or remediation due date. Operators should consult the vendor's GitHub security advisory below for current fix availability.
Sources
- NVD, CVE-2026-85154: https://nvd.nist.gov/vuln/detail/CVE-2026-85154
- WWBN AVideo GitHub Security Advisory (GHSA-59p8-6m2v-gcr5): https://github.com/WWBN/AVideo/security/advisories/GHSA-59p8-6m2v-gcr5
- VulnCheck Advisory; WWBN AVideo authentication bypass via non-expiring video_id_hash: https://www.vulncheck.com/advisories/wwbn-avideo-authentication-bypass-via-non-expiring-video-id-hash