CVE-2026-92578: fallo crítico en WWBN AVideo
WWBN AVideo through 29.0 Authentication Bypass via Stored Password Hash
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.2epss 0.6%
WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credential through two independent code paths in loginFromRequest() and encryptPasswordVerify(). Attackers who obtain the stored users.password hash value can authenticate as any user by submitting the hash directly to login endpoints, completely bypassing password verification.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
WWBN · AVideoCVEs relacionadas — WWBN AVideo
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-30690CRITICALCVE-2022-30690EPSS 83.9%CVE-2022-30534CRITICALCVE-2022-30534EPSS 75.0%CVE-2022-30547CRITICALCVE-2022-30547EPSS 63.7%CVE-2022-32572CRITICALCVE-2022-32572EPSS 24.1%CVE-2026-33478CRITICALAVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command InjectionEPSS 13.3%CVE-2023-32073HIGHAVideo command injection vulnerabilityEPSS 6.5%