A critical authentication bypass vulnerability exists in WWBN AVideo, allowing unauthenticated attackers to gain full administrative access to user accounts via replayed bearer tokens.

The application utilizes a video_id_hash that acts as a non-expiring and non-revocable bearer token. An unauthenticated attacker who obtains this token can replay it to impersonate the video owner with full administrative privileges, even if the owner resets their password.

Successful exploitation of this vulnerability results in a complete compromise of user accounts, including administrative sessions. Given the CVSS score of 9.8, this flaw presents an extreme risk, as it allows for unauthorized data access, potential content manipulation, and full account takeover without requiring any valid user credentials.

Immediate Action: Upgrade to the latest version of AVideo as soon as the vendor releases a patch that addresses the non-expiring nature of the video_id_hash. Until a patch is available, organizations should restrict access to the affected platform via network-level controls.

Proactive Monitoring: Review web server and application access logs for unusual patterns of authentication requests or repeated use of the same identifier across different sessions. Monitor for suspicious administrative actions originating from unauthorized IP addresses.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to inspect and filter traffic for known malicious patterns associated with AVideo authentication endpoints. Restrict access to the application to trusted networks via VPN or IP allowlisting to reduce the attack surface.

Public Exploit Available: Unknown

This vulnerability represents a severe threat to the integrity and confidentiality of AVideo installations. Security teams must prioritize patching as soon as the vendor provides a resolution, as the lack of credential expiration makes this an ideal target for persistent unauthorized access. Ensure that monitoring is active to detect any attempts to leverage stolen tokens until the environment is fully secured.