CVE-2026-126805
WWBN AVideo through 29.7.1 contains an incorrect authorization vulnerability that allows delegated Videos Admin users to obtain video_id_has
CVSS
7.2
High
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 11, 2026 · Last modified: Nov 11, 2026 · CWE-863
Not enough EPSS history yet.
WWBN AVideo through 29.7.1 contains an incorrect authorization vulnerability that allows delegated Videos Admin users to obtain video_id_hash values bound to any video owner via encoder endpoints like aVideoEncoderStatus.json.php. Attackers can request the hash for an administrator-owned video and replay it through useVideoHashOrLogin() for password-less login, gaining plugin upload, configuration, and user management access.
- github.comhttps://github.com/WWBN/AVideo/blob/v29.7.1/objects/EncoderJobStatus.php#L31-L42
- github.comhttps://github.com/WWBN/AVideo/blob/v29.7.1/objects/functions.php#L7619-L7647
- github.comhttps://github.com/WWBN/AVideo/commit/8252cb87de0639ae4d8c84c03d46f657948dca07
- github.comhttps://github.com/WWBN/AVideo/security/advisories/GHSA-8wjr-gw73-9f2g
- www.vulncheck.comhttps://www.vulncheck.com/advisories/wwbn-avideo-through-29.7.1-privilege-escalation-via-encoder-video-id-hash
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-126872——
———Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)3hCVE-2026-126866——
———Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: High)3hCVE-2026-126860——
———Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)3hCVE-2026-126854——
———Incorrect authorization in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)3hCVE-2026-126850——
———Incorrect authorization in SiteIsolation in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)3hCVE-2026-1262519.1 CRI—
———A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access.4h