WWBN AVideo through 29.7.1 Privilege Escalation via Encoder video_id_hash

Advisories

WWBN AVideo through 29.7.1 Privilege Escalation via Encoder video_id_hash

Severity: high
Date: 11/11/2026
Affecting: AVideo <= 29.7.1
CVE: CVE-2026-126805
CWE: CWE-863 Incorrect Authorization
CVSS: 8.6
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: GitHub Security Advisory (GHSA-8wjr-gw73-9f2g)
https://github.com/WWBN/AVideo/commit/8252cb87de0639ae4d8c84c03d46f657948dca07
https://github.com/WWBN/AVideo/blob/v29.7.1/objects/EncoderJobStatus.php#L31-L42
https://github.com/WWBN/AVideo/blob/v29.7.1/objects/functions.php#L7619-L7647
Credit: AlpetGexha
Description: WWBN AVideo through 29.7.1 contains an incorrect authorization vulnerability that allows delegated Videos Admin users to obtain video_id_hash values bound to any video owner via encoder endpoints like aVideoEncoderStatus.json.php. Attackers can request the hash for an administrator-owned video and replay it through useVideoHashOrLogin() for password-less login, gaining plugin upload, configuration, and user management access.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo