GHSA-wqcc-qf63-c2x4CriticalCVSS 9.8

WWBN AVideo Insufficient Entropy vulnerbaility

Published
January 10, 2024
Last Modified
November 4, 2025

🔗 CVE IDs covered (1)

📋 Description

An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HTTP requests can lead to privilege escalation. An attacker can gather system information via HTTP requests and bruteforce the salt offline, leading to forging a legitimate password recovery code for the admin user.

🎯 Affected products1

  • composer/wwbn/avideo:<= 12.4

🔗 References (4)