CVE-2026-84483

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to commit 9c39d8c8

Description An incomplete authentication bypass exists in the 'encryptPass.json.php' endpoint. This flaw allows unauthenticated attackers to compute valid HMAC (Hash-based Message Authentication Code) tokens using the public site URL and the current time. By computing hash hmac with the site's base URL as the key, attackers can forge authentication tokens and submit arbitrary passwords to obtain encrypted hashes, which facilitates offline precomputation attacks against stolen password databases.

Recommendations Update WWBN AVideo to commit 9c39d8c8 or a later version. As a temporary mitigation, restrict access to the 'encryptPass.json.php' endpoint.