Description

AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against an uninitialized session variable. Attackers with a victim's password can bypass the second factor by sending a parameter-less GET request to verifyChallenge.json.php, which evaluates null == null and marks authentication complete.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-17T12:18:30.440Z",
  "pubdate": "2026-09-17T12:18:30.440Z",
  "executiveSummary": "AVideo LoginControl contains an authentication bypass vulnerability within its PGP-based second-factor authentication (2FA) mechanism.\nThe vulnerability is rooted in an insecure comparison logic during the challenge-response verification process, specifically involving an uninitialized session variable.\nAn attacker who has successfully compromised or obtained a victim's primary password can circumvent the PGP 2FA requirement entirely by manipulating request parameters.\nThe impact of this vulnerability is critical, as it permits unauthorized access to user accounts, effectively neutralizing the security provided by the second-factor mechanism.\nExploitation requires the attacker to possess the victim's primary credentials and involves sending a specifically crafted HTTP GET request to the vulnerable endpoint.\nThis flaw represents a significant risk to organizational and user data confidentiality, potentially leading to unauthorized system administration or data exfiltration if an account with elevated privileges is compromised.",
  "technicalDetails": "The vulnerability exists within the AVideo LoginControl module, specifically in the implementation of the PGP second-factor verification logic located in verifyChallenge.json.php.\nThe root cause is an improper use of loose comparison operators in PHP when validating the challenge response. The authentication routine attempts to compare the user-provided response against a session-stored variable.\nIf the session variable intended to hold the challenge response is not properly initialized or is missing, the application evaluates the comparison against a null value.\nBy issuing a parameter-less GET request to verifyChallenge.json.php, an attacker forces the application to evaluate 'null == null'. Because PHP's loose equality operator (==) evaluates this condition as true, the application incorrectly flags the authentication process as successful.\nThe attack flow proceeds as follows: First, the attacker authenticates using the victim's primary password, reaching the second-factor prompt. Second, instead of providing a valid PGP signature or response, the attacker navigates to verifyChallenge.json.php without any GET parameters.\nThe server-side script retrieves an uninitialized session state for the challenge, resulting in a null value. The subsequent loose comparison check passes, and the script proceeds to set the user's session status to authenticated, bypassing the intended cryptographic verification.\nThis vulnerability is classified as an authentication bypass. Because it resides in the core login flow, it is exposed over the network, allowing remote exploitation by any entity that has obtained initial account credentials.\nThe post-exploitation impact includes the successful bypass of multi-factor authentication, granting the attacker full access to the victim's session. The integrity and confidentiality of the affected AVideo instance are effectively compromised, as the second layer of security has been rendered inert."
}