Critical AVideo Vulnerability Could Expose Password Hashes and Session Tokens (CVE-2026-86190)

A newly disclosed security vulnerability in WWBN AVideo, an open-source video-sharing platform, could allow unauthenticated attackers to access sensitive information belonging to users and potentially hijack active sessions.

Tracked as CVE-2026-86190, the flaw is a broken access control vulnerability affecting AVideo’s videoViewsInfo endpoints. The vulnerability has been assigned a CVSS score of 9.1, making it Critical. The issue was publicly recorded on September 5, 2026.

Sensitive user information exposed

According to the vulnerability description, the affected endpoint can return complete user records when a specially crafted hash parameter is supplied.

The exposed information can include:

• Password hashes
• Password recovery tokens
• Live session identifiers
• Other sensitive information associated with video viewers

Of particular concern is the exposure of session identifiers. An attacker could potentially use a disclosed session identifier to hijack an active user’s session, including accounts belonging to administrators.

Because the vulnerable functionality can be accessed without authentication, attackers would not necessarily need an existing AVideo account before attempting to obtain information.

Potential impact

The vulnerability could have serious consequences for websites running AVideo, particularly platforms with large numbers of registered users.

If an attacker successfully obtained a valid session identifier, they could potentially impersonate the affected user. Compromise of an administrator’s session could be especially serious, potentially giving an attacker access to administrative functionality and sensitive site information.

The disclosure of password hashes and account recovery information also creates additional risks. Although a password hash is not the same as a plaintext password, attackers may attempt offline attacks against weak or reused passwords.

Part of a wider AVideo security disclosure

CVE-2026-86190 is one of several vulnerabilities disclosed against AVideo on September 5.

Another issue, CVE-2026-86189, was rated even more severe at CVSS 9.8 and involves path traversal that could allow unauthenticated attackers to write files to arbitrary locations. Other newly disclosed AVideo vulnerabilities include an unauthenticated cross-site scripting flaw and weaknesses involving password generation and API rate limiting.

The concentration of vulnerabilities disclosed against the platform makes it particularly important for AVideo administrators to review their installations and ensure they are running versions containing the appropriate security fixes.

What administrators should do

Administrators running AVideo should check their installations for updates or security fixes from the project and apply them as soon as they become available.

They should also consider reviewing authentication and session logs for unusual activity, particularly if the affected endpoint has been exposed to the public internet.

Where there is evidence that sensitive session information may have been accessed, administrators should consider invalidating active sessions and requiring affected users to authenticate again.

With a 9.1 Critical CVSS rating and the possibility of exposing authentication-related information without requiring prior access, CVE-2026-86190 should be treated as a high-priority security issue for organisations operating AVideo-powered websites