Description

WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using the public site URL and current time. Attackers can forge authentication tokens by computing hash_hmac with the site's base URL as the key and submit arbitrary passwords to receive encrypted hashes, enabling offline precomputation attacks against stolen password databases.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-01T23:17:22.617Z",
  "pubdate": "2026-09-01T23:17:22.617Z",
  "executiveSummary": "WWBN AVideo, up to and including commit 9c39d8c8, is susceptible to an authentication bypass vulnerability within the encryptPass.json.php script.\nThis vulnerability stems from an insecure implementation of HMAC token generation, which relies on predictable parameters such as the public site URL and the current system time.\nThe flaw permits unauthenticated remote attackers to forge valid authentication tokens, enabling them to bypass standard security controls.\nBy submitting arbitrary password strings to the vulnerable endpoint, an attacker can obtain valid encrypted hashes.\nThis facilitates offline precomputation and brute-force attacks against user password databases, potentially leading to widespread account compromise and unauthorized system access.\nThe vulnerability poses a severe risk to confidentiality and integrity, as it lowers the barrier for credential harvesting and unauthorized impersonation within the application environment.",
  "technicalDetails": "The vulnerability is located in the encryptPass.json.php component of the WWBN AVideo platform. The root cause is an insecure and predictable token generation mechanism utilized for password encryption processes.\nThe application implements a hash_hmac function where the key is derived from the site's base URL, and the message content is influenced by the current timestamp. Because the base URL is public knowledge and the system time is easily obtainable, the HMAC generation process lacks the necessary entropy to ensure cryptographic security.\nAn unauthenticated attacker can replicate the token generation logic to produce valid HMAC signatures. By targeting the encryptPass.json.php endpoint, an adversary can submit arbitrary password strings to be processed by the server.\nThe exploitation flow proceeds as follows: First, the attacker identifies the site's base URL. Second, the attacker calculates the expected HMAC token using the current time as the message component. Third, the attacker crafts a malicious request to encryptPass.json.php, including the forged HMAC token and the target password payload.\nUpon receiving the request, the application fails to adequately validate the authenticity of the token, subsequently returning the encrypted password hash to the attacker. This process effectively exposes the server's encryption mechanisms to unauthorized users.\nWith the ability to obtain valid encrypted hashes for arbitrary inputs, an attacker can construct a rainbow table or perform high-speed offline dictionary attacks against existing user databases. This circumvents the intended security controls of the password hashing process.\nThe vulnerability affects all versions of WWBN AVideo through commit 9c39d8c8. The attack is executable over the network without requiring any prior authentication or special privileges, making it highly accessible to remote adversaries. Post-exploitation impact includes the full compromise of user credentials, facilitating further lateral movement or privilege escalation within the application ecosystem."
}