---
id: "CVE-2026-126805"
page: "https://infrastack.ai/live/CVE-2026-126805"
kind: "vulnerability"
aliases: ["CVE-2026-126805"]
title: "WWBN AVideo: delegated video admins can take over administrator accounts"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "WWBN AVideo", "fixed": [], "affected": "<= 29.7.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["package", "permissions-plugin", "php", "self-hosted", "wwbn-avideo"]
not_affected_if: ["newer-than-29.7.1", "no-delegated-video-admins", "no-videos-admin-group", "permissions-plugin-disabled"]
published_at: "2026-11-11T21:16:44+00:00"
first_seen_at: "2026-11-11T21:29:08+00:00"
updated_at: "2026-11-11T21:31:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126805", "first_seen_at": "2026-11-11T21:29:08+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-11T21:31:31+00:00"}]
exploit_sources: []
---

# WWBN AVideo: delegated video admins can take over administrator accounts

Link for people: https://infrastack.ai/live/CVE-2026-126805 (this .md is for agents)

WWBN AVideo through 29.7.1 lets delegated Videos Admin users fetch video_id_hash values tied to other owners, including administrators, through encoder endpoints such as aVideoEncoderStatus.json.php. An attacker replays such a hash through useVideoHashOrLogin() to log in without a password and gain plugin upload, configuration and user management access.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WWBN AVideo affected <= 29.7.1 fixed no fixed version listed

## How to check

Run AVideo <= 29.7.1 (all releases with the Permissions plugin are believed affected) without commit 8252cb87? In Admin > Users > User Groups, list who holds the Videos Admin permission. Any such account can become administrator. Look in web logs for POSTs to objects/aVideoEncoderStatus.json.php from those accounts, or from cookie-less clients that send video_id_hash.

## Fix

No patched release as of the advisory (Nov 11, 2026). Fix commit 8252cb87 is on master (binds video_id_hash to the issuing user); run a build containing it or wait for a release after 29.7.1. Until then, remove the Videos Admin permission from non-trusted users.

## Timeline

- 2026-11-11T21:29:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126805
- 2026-11-11T21:31:31+00:00 analyst — Read GHSA-8wjr-gw73-9f2g: patched versions None, <=29.7.1; commit 8252cb8 on master (Nov 11) adds issuer binding for video_id_hash but no release yet. PoC in advisory, no exploitation reported.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/WWBN/AVideo/security/advisories/GHSA-8wjr-gw73-9f2g
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/wwbn-avideo-through-29.7.1-privilege-escalation-via-encoder-video-id-hash
- [fix] Patch: github.com https://github.com/WWBN/AVideo/commit/8252cb87de0639ae4d8c84c03d46f657948dca07

## From the sources

WWBN AVideo through 29.7.1 contains an incorrect authorization vulnerability that allows delegated Videos Admin users to obtain video_id_hash values bound to any video owner via encoder endpoints like aVideoEncoderStatus.json.php. Attackers can request the hash for an administrator-owned video and replay it through useVideoHashOrLogin() for password-less login, gaining plugin upload, configuration, and user management access.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_