CVE-2026-59808 describes an authentication bypass vulnerability in WWBN AVideo present through commit 9c39d8c8. The function deduplicateByEncoderQueueId() returns video_id_hash credentials for any video identified by encoder_queue_id without verifying if the requester owns the video. Subsequently, useVideoHashOrLogin() converts this video_id_hash into a passwordless login session as the video owner. Attackers who have upload permissions can exploit this by omitting the videos_id parameter to retrieve an administrator's video_id_hash, then use it in an unauthenticated request to gain administrative session access and modify system configurations.

An attacker with upload permissions can bypass authentication controls to gain administrative access to the AVideo system. This unauthorized access allows modification of system configurations, potentially compromising the integrity and security of the platform. The vulnerability has a high severity score (CVSS 8.7) indicating significant impact if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict upload permissions to trusted users only and monitor for suspicious activity related to video_id_hash usage. Avoid omitting the videos_id parameter in requests and consider additional access control validations as a temporary mitigation.