CVE-2026-85154: Improper Privilege Management in WWBN AVideo

WWBN AVideo contains an authentication failure vulnerability identified as CVE-2026-85154. The vulnerability arises because the video_id_hash credential functions as a bearer token that does not expire or can be revoked. This token grants full administrator session access to the video owner's account. Consequently, attackers who obtain the video_id_hash can reuse it indefinitely to authenticate as the video owner with full privileges. The token's validity persists even after the video owner changes their password, indicating improper privilege management and session handling.

An attacker who obtains the video_id_hash token can gain full administrator access to the video owner's account indefinitely. This allows unauthorized access to all administrative functions and potentially sensitive data associated with the account. The vulnerability undermines account security by allowing persistent unauthorized access that is not mitigated by password changes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or mitigation is provided by WWBN, it is recommended to monitor for updates from the vendor. No temporary or official fixes are currently documented.