AVideo: Three High-Severity Flaws Including Auth Bypass and Command Injection Disclosed Together
AVideo platform faces high-severity flaws including authentication bypass, weak code generation, and command injection, disclosed in a single batch on September 17, 2026.
Key findings
- Three high-severity vulnerabilities disclosed for AVideo within a 14-hour window in September 2026.
- CVE-2026-92914 allows authentication bypass via PGP second-factor verification flaws.
- CVE-2026-92913 uses a cryptographically weak PRNG for account activation codes.
- CVE-2026-92580 in the CloneSite plugin enables stored OS command injection via SSH password handling.
- Users should update AVideo and the CloneSite plugin to patched versions immediately.
On September 17, 2026, a batch of three high-severity vulnerabilities was disclosed for the AVideo platform, impacting its security features and plugin functionality. These vulnerabilities, disclosed within a 14-hour window, highlight potential risks for AVideo users, particularly concerning authentication bypass, weak code generation, and command injection.
One of the critical issues, CVE-2026-92914, identified as an authentication bypass vulnerability in the PGP second factor verification, allows attackers with a victim's password to circumvent multi-factor authentication. This is achieved by exploiting a loose equality comparison with an uninitialized session variable when verifying challenge responses.
Another vulnerability, CVE-2026-92913, affects the generation of account activation and login pairing codes. Through commit c3edcc274c389816d434acadac07ee78eaf330c1, AVideo was found to use a cryptographically weak pseudo-random number generator. The getRandomCode() function in objects/functions.php relies on uniqid() with a single iteration, making the generated codes predictable and potentially exploitable.
The third vulnerability, CVE-2026-92580, resides within the CloneSite plugin, a popular add-on for AVideo. Affecting versions up to 29.0, this stored OS command injection flaw occurs in plugin/CloneSite/cloneClient.json.php. The plugin substitutes a stored SSH password directly into an sshpass -p command using str_replace without proper escaping. This allows an attacker to inject arbitrary commands by crafting a password containing a single quote.
The disclosed vulnerabilities present a significant risk to AVideo instances, particularly those with the CloneSite plugin enabled or relying on PGP second-factor authentication. Users are strongly advised to update their AVideo platform and the CloneSite plugin to the latest versions to mitigate these security risks. The vendor has addressed these issues, and applying the available patches is crucial for maintaining the security and integrity of AVideo deployments.
This batch of vulnerabilities underscores the importance of regular security audits and timely patching for all web applications, especially those with extensible plugin architectures. AVideo users should remain vigilant and ensure their systems are up-to-date to protect against potential exploitation.