CVE-2026-59808

Name of the Vulnerable Software and Affected Versions AVideo versions prior to commit 9c39d8c8

Description An authentication bypass exists where the deduplicateByEncoderQueueId() function returns video id hash credentials for any video based on the encoder queue id without verifying ownership. Subsequently, the useVideoHashOrLogin() function converts this hash into a passwordless login as the video owner. Users with upload permissions can retrieve an administrator's video id hash by omitting the videos id parameter, allowing them to use that hash in an unauthenticated request to obtain administrative session access and modify system configurations.

Recommendations Update AVideo to a version containing commit 9c39d8c8 or later.