PHP2Shell : See if you’re affected with a free external attack surface scan. Click Here > 

Back
New CVE Detected

CVE-2026-92913 – Authentication Bypass via Predictable Activation Codes – WWBN AVideo (through commi

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-92913 is a cryptographic weakness (CWE-330: Use of Insufficiently Random Values) in WWBN’s AVideo open-source video platform, affecting the getRandomCode() function used to generate account activation and login-pairing codes. Because the code is derived almost entirely from PHP’s uniqid() rather than a cryptographically secure random source, an unauthenticated remote attacker can brute-force a valid code within its short validity window and redeem it to take over a victim’s account. The issue carries a CVSS v4.0 base score of 9.1 (Critical).

Technical details

  • Root cause: getRandomCode() in objects/functions.php builds the activation/login code primarily from uniqid(), which encodes the server’s current Unix timestamp and microseconds; only a single additional character from PHP’s non-cryptographic rand() is appended as padding.
  • Effective entropy: This design reduces the real keyspace to roughly 2^25 (~36 million) possible values for any given generation second, far below what an eight-character alphanumeric code should provide.
  • Timing oracle: The unauthenticated endpoint plugin/API/set.json.php?APIName=login_code can be called without credentials and leaks the server’s exact microtime, letting an attacker narrow the generation-second window needed to brute-force a valid code.
  • Exploitation path: After guessing a valid, unexpired code (codes expire after 10 minutes), the attacker redeems it via plugin/API/get.json.php?APIName=login_code to receive the target account’s email address and a User::getUserHash(users_id, '+1 year') value — a token accepted in place of the account password for a full year.
  • Attack vector: Network, no authentication required, no user interaction required.
  • Impact: Full account takeover, including high confidentiality and integrity impact — the attacker gains a long-lived credential that authenticates as the victim and can read private account data.

Affected software

  • WWBN AVideo — all versions/builds through commit c3edcc274c389816d434acadac07ee78eaf330c1 on the master branch.
  • No patched version has been published at the time of disclosure.

Severity

  • CVSS v4.0: 9.1 (Critical) — CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
  • CVSS v3.1: 7.4 (High) — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Mitigation and recommended actions

  • Immediate: No official patched release is currently available. Monitor the WWBN/AVideo GitHub repository and security advisory for a fix, and upgrade as soon as a patched build is published.
  • Workarounds / network mitigations:
    • Restrict or disable public access to the plugin/API/set.json.php and plugin/API/get.json.php (APIName=login_code) endpoints where account activation via email link is not required, e.g., via a WAF rule or reverse-proxy access control.
    • Enforce or tighten existing per-IP rate limiting (currently five redemption attempts per 300 seconds) and add per-account attempt counters to slow brute-force attempts.
    • Reduce the activation/login code validity window below the default 10 minutes where configurable.
    • Monitor logs for repeated or high-volume requests to the login-code redemption endpoint, which may indicate brute-force attempts.
    • As a longer-term code fix (for self-hosted deployments able to patch), replace the uniqid()-based code generator with a cryptographically secure random value, e.g., bin2hex(random_bytes(...)).

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge