CVE-2026-84483 WWBN AVideo Unauthenticated Password Hash Oracle via encryptPass.json.php
Unauthenticated attackers can forge HMAC tokens to submit arbitrary passwords and obtain encrypted hashes, facilitating offline password cracking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-84483?
CVE-2026-84483 is a medium-severity authentication bypass vulnerability in WWBN AVideo, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using the public site URL and current time. Attackers can forge authentication tokens by computing hash_hmac with the site's base URL as the key and submit arbitrary passwords to receive encrypted hashes, enabling offline precomputation attacks against stolen password databases.
Weakness: CWE-321
Which versions are affected by CVE-2026-84483?
How do I fix CVE-2026-84483?
No fix has been published for CVE-2026-84483 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-84483 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-84483 exists.
Sources
Also known as GHSA-748m-wrhq-3hc2, GHSA-q92q-q2f7-v4fc.