CVE-2026-86187

Name of the Vulnerable Software and Affected Versions AVideo (affected versions not specified)

Description AVideo generates passwords for external-login accounts using the rand() function instead of a cryptographically secure generator, which limits the output to 31-bit integers. Additionally, the software uses unsalted MD5-based hashing for these passwords. This combination allows attackers who obtain the password hashes to recover the plaintext passwords quickly via offline brute-force attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.