CVE-2026-84483
published 2026-09-01CVE-2026-84483: WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid…
PriorityP339medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.45%
36.8th percentile
WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using the public site URL and current time. Attackers can forge authentication tokens by computing hash_hmac with the site's base URL as the key and submit arbitrary passwords to receive encrypted hashes, enabling offline precomputation attacks against stolen password databases.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wwbn | avideo | <= 9c39d8c8b4c1f75540788d6b391740852ceb0732 | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
WWBN AVideo encryptPass.json.php hash_hmac improper authentication (EUVD-2026-69725)
vuldb·2026-09-02·CVSS 5.3
CVE-2026-84483 [MEDIUM] WWBN AVideo encryptPass.json.php hash_hmac improper authentication (EUVD-2026-69725)
A vulnerability labeled as problematic has been found in WWBN AVideo. Affected is the function hash_hmac of the file encryptPass.json.php. Such manipulation leads to improper authentication.
This vulnerability is documented as CVE-2026-84483. The attack can be executed remotely. There is not any exploit available.
A patch should be applied to remediate this issue.
GHSA
WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using the public site URL an
ghsa_unreviewed·2026-09-02
CVE-2026-84483 [MEDIUM] CWE-321 WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using the public site URL an
WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using the public site URL and current time. Attackers can forge authentication tokens by computing hash_hmac with the site's base URL as the key and submit arbitrary passwords to receive encrypted hashes, enabling offline precomputation attacks against stolen password databases.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-01
Published