Description

WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a video_id_hash can replay it indefinitely to authenticate as the video owner with full privileges, and the credential remains valid even after the owner changes their password.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-03T13:06:22.067Z",
  "pubdate": "2026-09-03T13:06:22.067Z",
  "executiveSummary": "WWBN AVideo contains a critical authentication vulnerability involving the video_id_hash credential. This parameter functions as a non-expiring, non-revocable bearer token that provides full administrative session access to the associated video owner's account.\nThe vulnerability constitutes a broken authentication flaw where static identifiers are utilized for long-term session persistence without secondary validation or lifecycle management. Because the token is inherently tied to the video resource rather than a dynamic user session, it remains valid indefinitely, persisting even if the account password is modified.\nThe impact of this flaw is severe, allowing an attacker who intercepts or otherwise obtains a valid video_id_hash to bypass standard authentication mechanisms entirely. By replaying this token, an unauthorized party assumes the full privileges of the video owner. This vulnerability presents a high risk to data confidentiality and integrity, as it grants unfettered access to account management and sensitive video content. No specific exploitation requirements beyond the acquisition of the hash are noted, making it a passive yet highly effective vector for unauthorized account takeover.",
  "technicalDetails": "The vulnerability resides in the authentication logic handling of the video_id_hash parameter within WWBN AVideo. The system employs this hash as a primary bearer token for session identification, failing to bind it to a temporal session state or a revocable user-specific cookie mechanism.\nRoot Cause Analysis: The core issue is the design of the authentication protocol which relies on static, resource-based tokens. The video_id_hash is generated or assigned during resource creation and is subsequently honored by the application as a full authentication credential. This identifier lacks an expiration timestamp (TTL) and does not support administrative revocation, effectively making it a hardcoded 'backdoor' credential that is exposed to any entity with access to the hash.\nAttack Flow: 1. Identification: The attacker obtains a valid video_id_hash from public metadata, network traffic interception, or log file exposure. 2. Replay: The attacker transmits the captured video_id_hash in a request to the application's authentication-sensitive endpoints. 3. Authorization: The application validates the token against the backend database; because the token is not cross-referenced with current session status or password state, it validates the request as legitimate. 4. Privilege Escalation: Upon successful validation, the server creates an application state where the attacker is recognized as the account owner, granting full administrative access to all associated account functions.\nAuthentication and Privilege Requirements: There are no traditional authentication requirements for the attacker, as the video_id_hash replaces the need for user credentials. The attacker gains the same privilege level as the owner of the video account. The scope of impact is broad, encompassing any user account that has published content using this identifier scheme.\nPersistence and Post-Exploitation: The lack of revocation capability is particularly dangerous. If the target user becomes aware of a security breach and resets their password, the session remains active and the video_id_hash continues to function. This decoupling of session validity from user-managed security controls renders standard remediation steps like forced password resets ineffective. The attacker maintains continuous, indefinite access until the underlying video resource is removed or the application's authentication logic is fundamentally re-architected to use temporary, cryptographically secure session tokens."
}