Vulnerability · Published Sep 17, 2026 · Assigned by VulnCheck

CVE-2026-92914AVideo LoginControl PGP Second Factor Authentication Bypass

High 8.1

In plain English

A high-severity improper authentication in AVideo from WWBN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 58.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against an uninitialized session variable. Attackers with a victim's password can bypass the second factor by sending a parameter-less GET request to verifyChallenge.json.php, which evaluates null == null and marks authentication complete.

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	0 – through 29.0

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-mvmf-jqg6-qhjf) vendor-advisory
VulnCheck Advisory: AVideo LoginControl PGP Second Factor Authentication Bypass third-party-advisory