CVE-2026-86187— WWBN AVideo Weak PRNG Password Generation via External Login
Quick assessment
Affected
WWBN AVideo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 AVideo 中，用于外部登录账户的密码生成使用了 而非加密安全的随机数生成器，导致生成的密码仅为 31 位整数。由于哈希算法基于未加盐的 MD5，攻击者若能获取密码哈希值，可通过离线暴力破解在几分钟内还原出明文密码。
Possible ATT&CK Techniques 3 AI
T1110.001 · Password Guessing T1567 · Exfiltration Over Web Service T1110.003 · Password Spraying
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86187
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WWBN AVideo Weak PRNG Password Generation via External Login
Source: CVE Program / CVE List V5
Vulnerability Description
WWBN AVideo generates passwords for external-login accounts using rand() instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用不充分的随机数
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-86187
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86187
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-86187 (2)
Same Patch Batch · WWBN · 2026-09-05 · 5 CVEs total
| CVE-2026-86189 | 9.8 CRITICAL | WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php |
| CVE-2026-86190 | 9.1 CRITICAL | WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter |
| CVE-2026-86188 | 7.2 HIGH | AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting |
| CVE-2026-86186 | 6.5 MEDIUM | AVideo API Rate Limit Bypass via Bot User-Agent Header |
IV. Related Vulnerabilities
Same product: AVideo
-
CVE-2026-86189
WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg -
CVE-2026-86190
WWBN AVideo Broken Access Control via videoViewsInfo hash Pa -
CVE-2026-86188
AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting -
CVE-2026-86186
AVideo API Rate Limit Bypass via Bot User-Agent Header -
CVE-2026-85577
AVideo userLogin.php Reflected XSS via error parameter
Same vendor: WWBN
-
CVE-2026-86189
WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg -
CVE-2026-86190
WWBN AVideo Broken Access Control via videoViewsInfo hash Pa -
CVE-2026-86188
AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting -
CVE-2026-86186
AVideo API Rate Limit Bypass via Bot User-Agent Header -
CVE-2026-85577
AVideo userLogin.php Reflected XSS via error parameter
Same weakness: CWE-330
-
CVE-2026-17274
IBM i is Affected By Multiple Vulnerabilities in Debug Serve -
CVE-2026-3416
Predictable Pseudorandom Number Generation via Webhook HMAC -
CVE-2026-81852
AshAdmin ships a hardcoded CSP nonce, allowing nonce-based C -
CVE-2026-82555
TOTOLINK N600R Authentication cstecgi.cgi loginAuth random v -
CVE-2026-19485
Bucket Squatting in Vertex AI Search for Commerce
V. Comments for CVE-2026-86187
No comments yet