CVE-2026-59808: Missing Authentication for Critical Function in WWBN AVideo

AVideo versions up to commit 9c39d8c8 contain an authentication bypass vulnerability where deduplicateByEncoderQueueId() returns video_id_hash credentials for any video identified by encoder_queue_id without verifying ownership. The useVideoHashOrLogin() function then converts this hash into a passwordless login session as the video owner. An attacker with upload permission can omit the videos_id parameter to retrieve an administrator's video_id_hash and use it in an unauthenticated request to gain administrative session access and modify system configuration.

An attacker with upload permissions can bypass authentication controls to gain administrative session access. This allows unauthorized modification of system configuration, potentially compromising the entire application and its data integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict upload permissions to trusted users only and monitor for suspicious activity related to video_id_hash usage.