High severity8.1NVD Advisory· Published Sep 8, 2026· Updated Sep 10, 2026
CVE-2026-86722
CVE-2026-86722
Description
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates. Attackers with a valid password can bypass email two-factor authentication on new devices because the confirmation code hash fails to generate from the stale cached empty result.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
2News mentions
1- WWBN AVideo: Twelve Auth/Authz Bypass Vulnerabilities Disclosed TogetherVypr Intelligence · Sep 8, 2026