CyberRota Analysis
AI-GeneratedAVideo contains an authentication bypass vulnerability that allows attackers to exploit loose comparison logic in the LoginControl::verifyChallenge() function, enabling them to bypass PGP two-factor authentication with only a password. This flaw can lead to unauthorized access to user accounts, compromising sensitive data and system integrity. Organizations using AVideo should prioritize patching this vulnerability to protect against potential account takeovers.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability in LoginControl::verifyChallenge() that uses loose comparison (==) instead of strict comparison (===) against unset session values. Attackers with only a password can submit an empty request to verifyChallenge.json.php to bypass PGP two-factor authentication and gain full authenticated access.