CVE-2026-84483: Use of Hard-coded Cryptographic Key in WWBN AVideo

WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass vulnerability in encryptPass.json.php. This flaw allows unauthenticated attackers to compute valid HMAC tokens by using the public site URL as the cryptographic key and the current time as input. By forging authentication tokens in this manner, attackers can submit arbitrary passwords and receive encrypted hashes, facilitating offline precomputation attacks on stolen password databases. The vulnerability arises from the use of a hard-coded cryptographic key based on the site's base URL, weakening the security of the authentication mechanism.

An attacker can bypass authentication controls by forging valid HMAC tokens without any privileges or user interaction. This enables them to submit arbitrary passwords and obtain encrypted hashes, which can be used to perform offline attacks against password databases. The vulnerability compromises the integrity of the authentication process and increases the risk of credential compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected component if possible and monitor for suspicious activity related to authentication token generation. Avoid relying on hard-coded cryptographic keys derived from public information. Follow vendor updates closely for patches or official mitigations.