CVE-2026-59808 AVideo Authentication Bypass via Unkeyed Video Hash Disclosure
Attackers with upload permissions can bypass authentication to gain administrative access and modify system configuration in AVideo.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-59808?
CVE-2026-59808 is a high-severity authentication bypass vulnerability in WWBN AVideo, published on 22 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId() returns video_id_hash credentials for any video by encoder_queue_id without ownership verification, and useVideoHashOrLogin() converts this hash into passwordless login as the video owner. Attackers with upload permission can retrieve an administrator's video_id_hash by omitting the videos_id parameter, then use that hash in an unauthenticated request to gain administrative session access and modify system configuration.
Weakness: CWE-306
Which versions are affected by CVE-2026-59808?
How do I fix CVE-2026-59808?
No fix has been published for CVE-2026-59808 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-59808 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59808 exists.
Sources
Also known as GHSA-q32p-rw3q-8x3r, GHSA-wx4f-hq3h-2p8m.