CVE-2026-43875 affects WWBN AVideo (<= 29.0) where the OAuth login process leaks a sensitive password hash via an HTTP 302 redirect URL query string. The hash is derived as md5(hash("whirlpool", sha1(password))) and is stored in the users table. The login endpoint accepts an encodedPass=1 flag that bypasses hashing and compares the supplied value directly to the stored hash, making the hash effectively a plaintext credential. Exposure of this hash through server logs, referrer headers, or browser history allows full account takeover, including administrative privileges. A code commit referenced fixes this issue, but no official patch or advisory is documented in the provided data.

An attacker who can capture the OAuth redirect URL containing the password hash can impersonate the user without knowing the actual password. This leads to full account compromise, including admin accounts, resulting in confidentiality and integrity loss. The vulnerability has a medium CVSS score of 6.8, reflecting network attack vector, high impact on confidentiality and integrity, but requiring user interaction and high attack complexity.

No official patch or vendor advisory is provided in the available data. However, a code commit (977cd6930a97571a26da4239e25c8096dd4ecbc1) contains a fix addressing this vulnerability. Users of WWBN AVideo versions up to 29.0 should apply this fix or upgrade to a version including it. Until patched, avoid exposing OAuth redirect URLs containing sensitive query strings and consider monitoring and restricting access to logs and referrer data that might leak these URLs.