CVE-2026-92914

Name of the Vulnerable Software and Affected Versions AVideo (affected versions not specified)

Description An authentication bypass exists in the PGP second factor verification of the LoginControl component. The issue occurs because challenge responses are compared using loose equality against an uninitialized session variable. An attacker who possesses a victim's password can bypass the second factor authentication by sending a GET request without parameters to the 'verifyChallenge.json.php' endpoint, causing the system to evaluate null == null and mark the authentication as complete.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.