Description

AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId() returns video_id_hash credentials for any video by encoder_queue_id without ownership verification, and useVideoHashOrLogin() converts this hash into passwordless login as the video owner. Attackers with upload permission can retrieve an administrator's video_id_hash by omitting the videos_id parameter, then use that hash in an unauthenticated request to gain administrative session access and modify system configuration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-22T13:16:38.977Z",
  "pubdate": "2026-08-22T13:16:38.977Z",
  "executiveSummary": "AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability that allows attackers to achieve unauthorized administrative session access and modify system configurations.\nThe vulnerability arises from a combination of insecure credential retrieval and a passwordless login mechanism lacking proper ownership verification.\nSpecifically, the function deduplicateByEncoderQueueId() returns sensitive video_id_hash credentials associated with any video via the encoder_queue_id parameter without verifying asset ownership.\nSubsequently, the useVideoHashOrLogin() function translates this retrieved hash into an active session with full administrative privileges.\nAn attacker possessing basic upload permissions can exploit this flaw by omitting the videos_id parameter to illicitly harvest an administrator's video_id_hash.\nThis harvested hash is then utilized in subsequent unauthenticated requests to impersonate the administrator.\nThe risk implications are severe, as successful exploitation results in complete compromise of system integrity and administrative control over the AVideo instance.",
  "technicalDetails": "The vulnerability stems from improper authorization checks and insecure state transition logic within the AVideo codebase up to commit 9c39d8c8.\nThe primary vulnerable components involve the deduplicateByEncoderQueueId() function and the useVideoHashOrLogin() function.\nRoot cause analysis indicates that deduplicateByEncoderQueueId() fails to enforce access control lists or ownership validation when querying video identifiers.\nAs a result, it returns the video_id_hash credentials for any arbitrary video requested via the encoder_queue_id.\nThe auxiliary function useVideoHashOrLogin() accepts this video_id_hash and automatically processes it into a valid authenticated session corresponding to the owner of the specified video asset.\nThe step-by-step attack flow begins with an authenticated user holding standard upload privileges.\nFirst, the attacker interacts with the application interface or API endpoint responsible for queue deduplication, specifically crafting a request that omits the standard videos_id parameter.\nDue to the absence of input validation and ownership verification, the deduplicateByEncoderQueueId() function processes the request and leaks the video_id_hash belonging to a privileged administrator who also owns a targeted video within the system.\nSecond, the attacker extracts the leaked administrator video_id_hash.\nThird, the attacker issues an unauthenticated HTTP request to the useVideoHashOrLogin() endpoint, supplying the harvested administrative video_id_hash as the primary authentication payload.\nThe application processes the hash, treats it as a valid cryptographic proof of identity, and establishes an active administrative session for the attacker.\nPost-exploitation impact includes full administrative access, allowing the malicious actor to execute privileged functionalities, alter core system settings, manipulate hosted media, and compromise underlying server resources."
}