WWBN AVideo through version 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credential via two independent code paths: loginFromRequest() and encryptPasswordVerify(). This means that if an attacker obtains the users.password hash value from the database or other means, they can directly authenticate as any user without knowing the actual password, completely bypassing password verification controls.

An attacker with access to the stored password hash can fully bypass authentication and gain unauthorized access to any user account. This compromises account confidentiality and integrity, potentially leading to full system compromise depending on user privileges. The vulnerability has a CVSS 4.0 score of 9.2, indicating critical severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to stored password hashes and monitor for unauthorized access attempts. Avoid exposing password hashes in backups, logs, or through other means. Follow vendor updates closely for an official patch or temporary mitigations.