🚨 [CRITICAL AUTH BYPASS] — AVIDEO TOKEN FLAW CAN GRANT FULL ADMIN ACCESS EVEN AFTER THE OWNER CHANGES THEIR PASSWORD CVE-2026-85154 turns a `video_id_hash` into a non-expiring, non-revocable bearer credential capable of authenticating as a video's owner with full privileges. CyberSignal Priority: 🔴 VERY HIGH 📅 September 3, 2026 🔐 CVE-2026-85154 📊 CVSS v3.1: 9.8 CRITICAL 📊 CVSS v4.0: 9.3 CRITICAL 🏢 WWBN AVideo ⚠️ Affected: AVideo ≤29.0 🏷️ Authentication Bypass · Account Takeover · Bearer Tokens ### 🔎 What happened A new vulnerability was disclosed today in: WWBN AVIDEO. AVideo uses a value called: `video_id_hash`. But the vulnerable implementation effectively allows that value to behave as: AN AUTHENTICATION CREDENTIAL. If an attacker obtains a valid hash: HASH ↓ replayed to application ↓ owner session created ↓ FULL ACCOUNT PRIVILEGES. ### 🔥 The worst part The token is described as: NON-EXPIRING and: NON-REVOCABLE. That means: attacker steals token ↓ owner discovers suspicious activity ↓ owner changes password ↓ ATTACKER'S TOKEN STILL WORKS. A password reset does not automatically remove the stolen access. ### 🎯 Impact Successful exploitation can provide: full administrator-level session access read/write access account impersonation configuration changes potential downstream compromise. The exact blast radius depends on the privileges of: THE VIDEO OWNER. ### 🧠 Why this matters Modern security assumes credentials have a lifecycle: ISSUE ↓ USE ↓ EXPIRE ↓ ROTATE ↓ REVOKE. A credential that cannot expire or be revoked violates that model. Once stolen: TIME NO LONGER HELPS THE DEFENDER. ### ⚠️ Important caveat The attacker must first obtain a valid: `video_id_hash`. The CVE does NOT mean an attacker can simply choose any username on any AVideo server without possessing the relevant credential. But after obtaining it, the CVSS assessment reflects: network attack low complexity no privileges no user interaction. ### 🛡️ Defender action Organizations running AVideo ≤29.0 should: review the vendor advisory ↓ apply the available remediation/update ↓ assume exposed hashes may remain usable ↓ review web/access logs ↓ look for unexpected authenticated sessions ↓ rotate affected credentials where supported. Do NOT assume: PASSWORD RESET = ATTACKER REMOVED. ### 🧠 CyberSignal insight A password is only one credential. If another token can recreate your authenticated session forever: THE PASSWORD WAS NEVER YOUR REAL SECURITY BOUNDARY. Sources: VulnCheck · CVE · NVD · GitHub Security Advisory
Post summary
A new authentication bypass in AVideo (CVE-2026-85154) allows non‑expiring bearer tokens to be replayed for full admin access. The post discloses vulnerability details, impact, CVSS scores, and advises applying the vendor patch.