CVE-2026-85154 WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash
Attackers can use non-expiring video_id_hash tokens to bypass authentication and gain full administrator access to user accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85154?
CVE-2026-85154 is a critical authentication bypass vulnerability in WWBN AVideo, published on 3 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a video_id_hash can replay it indefinitely to authenticate as the video owner with full privileges, and the credential remains valid even after the owner changes their password.
Weakness: CWE-269
Which versions are affected by CVE-2026-85154?
How do I fix CVE-2026-85154?
No fix has been published for CVE-2026-85154 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-85154 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-85154 exists.
Sources
Also known as GHSA-59p8-6m2v-gcr5, GHSA-c44x-r4cw-m5fr.