The vulnerability in WWBN AVideo is due to improper authentication logic in the LoginControl::verifyChallenge() method. Specifically, the code uses loose comparison (==) against unset session variables, which can be exploited by an attacker with a valid password to bypass the PGP two-factor authentication mechanism. By submitting an empty request to the verifyChallenge.json.php endpoint, the attacker can circumvent the second factor and achieve full authenticated access to the application.

An attacker with only a valid password can bypass the PGP two-factor authentication, gaining full authenticated access to the AVideo application. This elevates the risk of unauthorized access to user accounts and potentially sensitive data or administrative functions within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider additional compensating controls such as restricting access to the affected endpoint or disabling PGP two-factor authentication if feasible.