The vulnerability in AVideo's LoginControl component arises from improper authentication logic in the PGP second factor verification process. Specifically, the challenge response comparison uses loose equality against an uninitialized session variable. This allows an attacker with valid user credentials to bypass the second factor authentication by triggering a parameter-less GET request to verifyChallenge.json.php, which evaluates null == null and marks the authentication as successful without proper verification.

An attacker who has obtained a victim's password can bypass the second factor authentication, effectively reducing the authentication process to single-factor. This increases the risk of unauthorized access to user accounts despite the presence of two-factor authentication, potentially leading to account compromise and unauthorized actions within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider additional compensating controls such as monitoring for suspicious login activity and restricting access where possible.