AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 generates account activation and login pairing codes using getRandomCode(), which derives codes primarily from uniqid() (sprintf('%08x%05x', seconds, microseconds)) and a single rand() character for padding. This approach produces approximately 36 million possible codes per second, which is insufficiently random. The API endpoint plugin/API/set.json.php?APIName=login_code is accessible without authentication and reveals the server's exact microtime, enabling an attacker to reduce the guessing space. If an attacker guesses a valid, unexpired code (valid for 10 minutes), they can redeem it at plugin/API/get.json.php?APIName=login_code to obtain the account's email and a User::getUserHash(users_id, '+1 year') value. This hash acts as a credential accepted in place of the password for one year, allowing account takeover. There is no known patch or fix available for this vulnerability.

An unauthenticated remote attacker can exploit this vulnerability to guess valid login pairing codes due to insufficient randomness and an oracle that reveals server microtime. Successful exploitation leads to disclosure of the target account's email and a long-lived credential that bypasses the password, enabling full account takeover. This compromises account confidentiality and integrity.

No patch or official fix is currently available for this vulnerability. Users and administrators should monitor vendor advisories for updates. Until a fix is released, consider restricting access to the vulnerable API endpoints if possible or implementing additional access controls to reduce exposure.