Description
WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a video_id_hash can replay it indefinitely to authenticate as the video owner with full privileges, and the credential remains valid even after the owner changes their password.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WWBN | AVideo | ≤ 29.0 | — |
References
- GitHub Security Advisory (GHSA-59p8-6m2v-gcr5) vendor-advisory
- VulnCheck Advisory: WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash third-party-advisory