CyberRota Analysis
AI-GeneratedAVideo is vulnerable due to an authentication bypass flaw that allows attackers with upload permissions to access an administrator's video_id_hash by manipulating the encoder_queue_id parameter. This exploit enables unauthorized users to perform passwordless logins as the video owner, potentially leading to unauthorized access and modification of system configurations. Organizations utilizing AVideo should prioritize patching this vulnerability to prevent potential administrative access breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId() returns video_id_hash credentials for any video by encoder_queue_id without ownership verification, and useVideoHashOrLogin() converts this hash into passwordless login as the video owner. Attackers with upload permission can retrieve an administrator's video_id_hash by omitting the videos_id parameter, then use that hash in an unauthenticated request to gain administrative session access and modify system configuration.