CVE-2026-86187: Use of Insufficiently Random Values in WWBN AVideo

CVE-2026-86187 describes a vulnerability in WWBN AVideo where passwords for external-login accounts are generated using the non-cryptographic rand() function, producing only 31-bit integer values. These passwords are hashed using unsalted MD5, which is cryptographically weak. An attacker who obtains password hashes can perform offline brute-force attacks to recover plaintext passwords within minutes. The vulnerability affects versions from 0 up to and including 29.0. The CVSS 4.0 score is 7.4, indicating high severity, with network attack vector, high attack complexity, and requiring privileged attacker access.

Attackers with access to password hashes can efficiently recover plaintext passwords due to the weak password generation and unsalted MD5 hashing. This compromises the security of external-login accounts, potentially allowing unauthorized access. The attack requires privileged attacker access and has high attack complexity, limiting exposure to certain threat scenarios.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to password hashes and monitoring for unauthorized access. Avoid relying on the affected password generation mechanism.