{"id":"CVE-2026-126805","kind":"vulnerability","aliases":["CVE-2026-126805"],"related":[],"title":"WWBN AVideo: delegated video admins can take over administrator accounts","description":"WWBN AVideo through 29.7.1 contains an incorrect authorization vulnerability that allows delegated Videos Admin users to obtain video_id_hash values bound to any video owner via encoder endpoints like aVideoEncoderStatus.json.php. Attackers can request the hash for an administrator-owned video and replay it through useVideoHashOrLogin() for password-less login, gaining plugin upload, configuration, and user management access.","summary":"WWBN AVideo through 29.7.1 lets delegated Videos Admin users fetch video_id_hash values tied to other owners, including administrators, through encoder endpoints such as aVideoEncoderStatus.json.php. An attacker replays such a hash through useVideoHashOrLogin() to log in without a password and gain plugin upload, configuration and user management access.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WWBN AVideo","fixed":[],"affected":"<= 29.7.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["package","permissions-plugin","php","self-hosted","wwbn-avideo"],"not_affected_if":["newer-than-29.7.1","no-delegated-video-admins","no-videos-admin-group","permissions-plugin-disabled"],"how_to_check":"Run AVideo <= 29.7.1 (all releases with the Permissions plugin are believed affected) without commit 8252cb87? In Admin > Users > User Groups, list who holds the Videos Admin permission. Any such account can become administrator. Look in web logs for POSTs to objects/aVideoEncoderStatus.json.php from those accounts, or from cookie-less clients that send video_id_hash.","fix":"No patched release as of the advisory (Nov 11, 2026). Fix commit 8252cb87 is on master (binds video_id_hash to the issuing user); run a build containing it or wait for a release after 29.7.1. Until then, remove the Videos Admin permission from non-trusted users.","status":"open","published_at":"2026-11-11T21:16:44+00:00","first_seen_at":"2026-11-11T21:29:08+00:00","triaged_at":"2026-11-11T21:30:40+00:00","updated_at":"2026-11-11T21:31:31+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-11T21:30:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"WWBN AVideo: delegated video admins can take over administrator accounts","impact":"high","summary":"WWBN AVideo through 29.7.1 lets delegated Videos Admin users fetch video_id_hash values tied to other owners, including administrators, through encoder endpoints such as aVideoEncoderStatus.json.php. An attacker replays such a hash through useVideoHashOrLogin() to log in without a password and gain plugin upload, configuration and user management access.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wwbn-avideo","self-hosted","php"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker takes over administrator account and installs plugins","analyst_note":"Fixed version and patch details are only in the GitHub patch and vendor advisory links; confirm the fixed release and the exact endpoint behaviour there.","how_to_check":"- Check the installed AVideo version; the sources say the flaw covers all releases through `29.7.1`.\n- Look for delegated Videos Admin accounts in the admin user list.\n- Review web server logs for requests to `aVideoEncoderStatus.json.php` from non-administrator accounts.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-delegated-video-admins","newer-than-29.7.1"],"who_is_affected":"Sites that run WWBN AVideo through version 29.7.1 and give anyone the delegated Videos Admin role are exposed. Installations without delegated Videos Admin users, or running a version newer than 29.7.1, are not covered by the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000781,"input_tokens":4657,"output_tokens":631,"severity_before":"high"},"analyst_status":"done","analyst_note":"Fixed version and patch details are only in the GitHub patch and vendor advisory links; confirm the fixed release and the exact endpoint behaviour there.","search":"'-126805':13A,16A '-2026':12A,15A '29.7.1':33B,82C 'access':78B,138C 'account':10A 'admin':5A,37B,92C 'administr':9A,49B,118C 'administrator-own':117C 'allow':89C 'attack':57B,110C 'author':86C 'avideo':2A,18A,29B,31B,80C 'avideoencoderstatus.json.php':55B,109C 'bound':100C 'configur':74B,134C 'contain':83C 'cve':11A,14A 'deleg':3A,35B,90C 'encod':51B,106C 'endpoint':52B,107C 'fetch':39B 'gain':71B,131C 'hash':42B,61B,98C,114C 'host':26B 'id':41B,97C 'includ':48B 'incorrect':85C 'less':129C 'let':34B 'like':108C 'log':65B 'login':130C 'manag':77B,137C 'obtain':95C 'own':119C 'owner':47B,104C 'packag':19B 'password':69B,128C 'password-less':127C 'permiss':21B 'permissions-plugin':20B 'php':23B 'plugin':22B,72B,132C 'replay':58B,122C 'request':112C 'self':25B 'self-host':24B 'take':7A 'tie':44B 'upload':73B,133C 'user':38B,76B,93C,136C 'usevideohashorlogin':63B,125C 'valu':43B,99C 'via':105C 'video':4A,36B,40B,91C,96C,103C,120C 'vulner':87C 'without':67B 'wwbn':1A,17A,28B,30B,79C 'wwbn-avideo':27B","nicknames":[],"mitigations":[],"who_affected":"Sites that run WWBN AVideo through version 29.7.1 and give anyone the delegated Videos Admin role are exposed. Installations without delegated Videos Admin users, or running a version newer than 29.7.1, are not covered by the sources.","tier":"B","verified":{"fix":{"at":"2026-11-11T21:31:31Z","by":"analyst","doc":"https://github.com/WWBN/AVideo/commit/8252cb87de0639ae4d8c84c03d46f657948dca07","run_id":3598},"products":{"at":"2026-11-11T21:31:31Z","by":"analyst","doc":"https://github.com/WWBN/AVideo/commit/8252cb87de0639ae4d8c84c03d46f657948dca07","run_id":3598},"who_affected":{"at":"2026-11-11T21:31:31Z","by":"analyst","doc":"https://github.com/WWBN/AVideo/commit/8252cb87de0639ae4d8c84c03d46f657948dca07","run_id":3598}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["avideo","wwbnavideo"],"ptokens":["avideo","wwbn"],"labels":["high","package","permissionsplugin","php","selfhosted","wwbnavideo"],"campaign_type":null,"search_a":"'-126805':13A,16A '-2026':12A,15A 'account':10A 'admin':5A 'administr':9A 'avideo':2A,18A 'cve':11A,14A 'deleg':3A 'take':7A 'video':4A 'wwbn':1A,17A","search_b":"'29.7.1':33B 'access':78B 'admin':37B 'administr':49B 'attack':57B 'avideo':29B,31B 'avideoencoderstatus.json.php':55B 'configur':74B 'deleg':35B 'encod':51B 'endpoint':52B 'fetch':39B 'gain':71B 'hash':42B,61B 'host':26B 'id':41B 'includ':48B 'let':34B 'log':65B 'manag':77B 'owner':47B 'packag':19B 'password':69B 'permiss':21B 'permissions-plugin':20B 'php':23B 'plugin':22B,72B 'replay':58B 'self':25B 'self-host':24B 'tie':44B 'upload':73B 'user':38B,76B 'usevideohashorlogin':63B 'valu':43B 'video':36B,40B 'without':67B 'wwbn':28B,30B 'wwbn-avideo':27B","search_c":"'29.7.1':82C 'access':138C 'admin':92C 'administr':118C 'administrator-own':117C 'allow':89C 'attack':110C 'author':86C 'avideo':80C 'avideoencoderstatus.json.php':109C 'bound':100C 'configur':134C 'contain':83C 'deleg':90C 'encod':106C 'endpoint':107C 'gain':131C 'hash':98C,114C 'id':97C 'incorrect':85C 'less':129C 'like':108C 'login':130C 'manag':137C 'obtain':95C 'own':119C 'owner':104C 'password':128C 'password-less':127C 'plugin':132C 'replay':122C 'request':112C 'upload':133C 'user':93C,136C 'usevideohashorlogin':125C 'valu':99C 'via':105C 'video':91C,96C,103C,120C 'vulner':87C 'wwbn':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T14:36:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126805","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126805","severity":null,"published_at":"2026-11-11T21:16:44+00:00","modified_at":"2026-11-11T21:16:44+00:00","first_seen_at":"2026-11-11T21:29:08+00:00","fetched_at":"2026-11-11T21:29:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126805:3598","url":null,"severity":null,"published_at":"2026-11-11T21:31:31+00:00","modified_at":"2026-11-11T21:31:31+00:00","first_seen_at":"2026-11-11T21:31:31+00:00","fetched_at":"2026-11-11T21:31:31+00:00","note":"Read GHSA-8wjr-gw73-9f2g: patched versions None, <=29.7.1; commit 8252cb8 on master (Nov 11) adds issuer binding for video_id_hash but no release yet. PoC in advisory, no exploitation reported."}],"documents":[{"id":128973,"url":"https://github.com/WWBN/AVideo/commit/8252cb87de0639ae4d8c84c03d46f657948dca07","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128974,"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-8wjr-gw73-9f2g","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-11T14:36:13+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":128975,"url":"https://www.vulncheck.com/advisories/wwbn-avideo-through-29.7.1-privilege-escalation-via-encoder-video-id-hash","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}