CVE-2026-92913

Name of the Vulnerable Software and Affected Versions AVideo versions prior to commit c3edcc274c389816d434acadac07ee78eaf330c1

Description The software uses a cryptographically weak pseudo-random number generator to create account activation and login pairing codes. The getRandomCode() function in objects/functions.php derives codes from uniqid(), which uses seconds and microseconds, with a single rand() character for padding. This significantly reduces the possible code values for a known generation second. The endpoint 'plugin/API/set.json.php?APIName=login code' can be accessed without authentication and acts as an oracle for the server's exact microtime. An unauthenticated remote attacker who guesses a valid, unexpired code can use the endpoint 'plugin/API/get.json.php?APIName=login code' to retrieve the target account's email address and a User::getUserHash(users id, '+1 year') value. This hash is accepted as a password for one year, allowing for full account takeover.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.