Staging Environment: Content and features may be unstable or change without notice.
Advisory details: vulnrichment / CVE-2026-43875
Advisory ID vulnrichment/CVE-2026-43875
Aliases
Summary WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/MobileManager/oauth2.php completes an OAuth login by sending an HTTP 302 Location: oauth2Success.php?user=<email>&pass=<HASH> where <HASH> is the victim's stored password hash (md5(hash("whirlpool", sha1(password)))) read directly from the users table. AVideo's own login endpoint (objects/login.json.php) accepts an encodedPass=1 flag that bypasses hashing and performs a direct string comparison between the supplied value and the stored hash. Anyone who captures the redirect URL — via server logs, referrer leakage, or browser history — therefore obtains a credential equivalent to the plaintext password and can fully take over the account, including admin accounts. Commit 977cd6930a97571a26da4239e25c8096dd4ecbc1 contains an updated fix.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-598 Use of GET Request Method With Sensitive Query Strings
System Score Found at
cvssv3.1 6.8
ssvc Track*
Reference id Reference type URL
977cd6930a97571a26da4239e25c8096dd4ecbc1 Other https://github.com/WWBN/AVideo/commit/977cd6930a97571a26da4239e25c8096dd4ecbc1
GHSA-5w8w-26ch-v5cw Other https://github.com/WWBN/AVideo/security/advisories/GHSA-5w8w-26ch-v5cw
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Found at None
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-05-12T13:24:08Z/ Found at None

Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-05-12T13:24:08Z/

Decision: Track*

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/43xxx/CVE-2026-43875.json

Source Advisory: vulnrichment/CVE-2026-43875

View SSVC decision tree 
[{'Exploitation': 'poc'},
 {'Automatable': 'no'},
 {'Technical Impact': 'total'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]