CVE-2026-92913 WWBN CVE debrief

Who should care

Defenders responsible for AVideo installations, security teams, and administrators should assess exposure and implement compensating controls due to the potential for account takeover.

Why it matters

Defenders should prioritize verifying exposure and implementing compensating controls due to the potential for account takeover through guessable activation codes in AVideo. The vulnerability allows an unauthenticated remote attacker to guess and redeem a valid code to obtain the target account's email address and a credential accepted in place of the account password for one year. Security teams and administrators responsible for AVideo installations should assess exposure and implement measures to prevent exploitation.

• Account takeover through guessable activation codes
• Potential for unauthorized access to sensitive information
• Need for compensating controls to prevent exploitation
• Verification of AVideo installation for exposure

Technical summary

AVideo uses a cryptographically weak pseudo-random number generator when creating account activation and login pairing codes. The getRandomCode() function in objects/functions.php derives the code entirely from uniqid() with a single non-CSPRNG rand() character used only as padding, reducing the code space to roughly 36 x 10^6 (~2^25) values for a known generation second. An unauthenticated remote attacker who guesses a valid, unexpired code can redeem it to obtain the target account's email address and a User::getUserHash(users_id, '+1 year') value, a credential accepted in place of the account password for one year, resulting in account takeover.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls due to the potential for account takeover.

Recommended defensive actions

• Verify AVideo installation for exposure
• Implement compensating controls to prevent account takeover
• Monitor for suspicious account activity
• Consider applying alternative authentication mechanisms
• Review vendor guidance for patching or mitigation
• Conduct an asset inventory to identify potentially affected systems
• Track changes to AVideo deployments for verification of remediation

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 9.1 and critical severity. The vulnerability is caused by the use of a cryptographically weak pseudo-random number generator in AVideo.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.