CVE-2026-92913
CRITICAL 9.1 PoC AVAILABLE ALL-YEARSAVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairing codes. getRandomCode() in objects/functions.php derives the code entirely from uniqid() (sprintf('%08x%05x', seconds, microseconds)) with a single non-CSPRNG rand() character used only as padding, reducing the code space to roughly 36 x 10^6 (~2^25) values for a known generation second. Because plugin/API/set.json.php?APIName=login_code can be called without authentication, it also serves as an oracle for the server's exact microtime. An unauthenticated remote attacker who guesses a valid, unexpired code (codes expire after 10 minutes) can redeem it at plugin/API/get.json.php?APIName=login_code to obtain the target account's email address and a User::getUserHash(users_id, '+1 year') value, a credential accepted in place of the account password for one year, resulting in account takeover. No patched version is available.
Public exploit or PoC code exists. The barrier to attack is reduced — watch closely.
Exploitation likelihood
0.5%chance of exploitation in 30 days · 43rd percentile
Impact if exploited
9.1CVSS 4.0 · CRITICAL · CNA
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ⚠Complexity: Needs a race window or specific setup
- ⚠Requirements: Specific conditions must be present
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept & exploit code
- reference https://github.com/WWBN/AVideo/security/advisories/GHSA-v65f-hc7x-wj62
- github-search https://github.com/search?q=%22CVE-2026-92913%22&type=repositories
Test against your own equipment
curl -s https://vulnpedia.com/cve/CVE-2026-92913/poc.jsonMachine-readable PoC index for this CVE (for automation).For defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-92913/poc.json
Weakness (CWE)
- CWE-330: Use of Insufficiently Random Values
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
All CVSS metrics
- CRITICAL 9.1 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - HIGH 7.4 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - CRITICAL 9.1 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - HIGH 7.4 v3.1 · NVD Primary
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N