An authentication bypass vulnerability in WWBN AVideo allows unauthorized users to gain account access, posing a severe risk to platform integrity.

This flaw exists in the authentication logic where deduplicateByEncoderQueueId and useVideoHashOrLogin functions fail to verify ownership before issuing credentials. An attacker with low privileges can leverage this to bypass authentication mechanisms and impersonate other users.

The ability to bypass authentication and impersonate users presents a critical threat to data confidentiality and system integrity. An attacker could gain full control over victim accounts, leading to unauthorized access to sensitive media, administrative functions, or user data. With a CVSS score of 8.8, this high severity vulnerability warrants immediate attention to prevent account takeover incidents.

Immediate Action: Update the AVideo installation to a version beyond commit 9c39d8c8b4c1f75540788d6b391740852ceb0732 as provided by the vendor.

Proactive Monitoring: Review application access logs for unusual patterns of authentication, specifically looking for accounts accessing resources without standard login flows.

Compensating Controls: Deploy a Web Application Firewall to monitor and block suspicious requests targeting video processing or authentication endpoints.

Public Exploit Available: No (no confirmed public exploit)

The severity of this authentication bypass requires immediate action to secure the AVideo environment. Administrators should verify their current commit hash and apply the necessary updates to ensure that ownership verification is properly enforced for all sessions.