CVE-2026-92913

What it is

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairing codes. getRandomCode() in objects/functions.php derives the code entirely from uniqid() (sprintf('%08x%05x', seconds, microseconds)) with a single non-CSPRNG rand() character used only as padding, reducing the code space to roughly 36 x 10^6 (~2^25) values for a known generation second. Because plugin/API/set.json.php?APIName=login_code can be called without authentication, it also serves as an oracle for the server's exact microtime. An unauthenticated remote attacker who guesses a valid, unexpired code (codes expire after 10 minutes) can redeem it at plugin/API/get.json.php?APIName=login_code to obtain the target account's email address and a User::getUserHash(users_id, '+1 year') value, a credential accepted in place of the account password for one year, resulting in account takeover. No patched version is available.

At a glance

Exploitability

Can be exploited over the network without logging in. High risk of data exposure, data tampering.

Exploit odds

0.5% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-09-17 12:18 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-22 20:43 UTC Last updatedMost recent change to the record

Details

Published

2026-09-17 12:18 UTC

Last modified

2026-09-22 20:43 UTC

Exploit probability

0.5% · EPSS, next 30 days

Weakness

CWE-330

Record status

Deferred

Attack profile CVSS 4.0 · 9.1

Attack vector

Network

Complexity

High

Attack requirements

Present

Privileges needed

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

None