CVE-2026-92914— AVideo LoginControl PGP Second Factor Authentication Bypass

Quick assessment

Copy summary Copy citation

Affected

WWBN AVideo

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AVideo 登录控件（LoginControl）中存在一个认证绕过漏洞。该漏洞位于 PGP 双因子验证环节：系统在比对挑战响应值时，使用了松散等于（loose equality）与一个未初始化的会话变量进行比较。 攻击者若已知受害者的密码，即可通过向 发起一个不带参数的 GET 请求来绕过双因子验证。由于会话变量未被初始化（即值为 ），而请求也未携带任何挑战响应参数（参数值同样为 ），导致 评估为真，系统因此将认证标记为已完成，从而实现绕过双因子验证。

CVE-2026-92914 affects WWBN AVideo. No confirmed in-the-wild exploitation; assess based on exposure. AVideo 登录控件（LoginControl）中存在一个认证绕过漏洞。该漏洞位于 PGP 双因子验证环节：系统在比对挑战响应值时，使用了松散等于（loose equality）与一个未初始化的会话变量进行比较。 攻击者若已知受害者的密码，即可通过向 发起一个不带参数的 GET 请求来绕过双因子验证。由于会话变量未被初始化（即值为 ），而请求也未携带任何挑 CVE-2026-92914 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2026-92914

I. Basic Information for CVE-2026-92914

Affected Products

II. Public POCs for CVE-2026-92914

III. Intelligence Information for CVE-2026-92914

Vendor Advisories for CVE-2026-92914 (2)

• 🔗 Identification and Authentication Failures: LoginControl's PGP second factor is satisfied by a single parameter-less GET, because the challenge is compared with == against a session value that is unset until the challenge page is rendered · Advisory · WWBN/AVideo · GitHub Read full article vendor-advisory
• 🔗 AVideo LoginControl PGP Second Factor Authentication Bypass | Advisories | VulnCheck third-party-advisory

• https://www.cve.org/CVERecord?id=CVE-2026-92914

Same Patch Batch · WWBN · 2026-09-17 · 4 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-92914