CVE-2026-86722 — AVideo Authentication Bypass via SQL Cache Invalidation
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalida…
Published: 2026-09-08 · CVSS: 8.6 · CVSS 4.0
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates. Attackers with a valid password can bypass email two-factor authentication on new devices because the confirmation code hash fails to generate from the stale cached empty result.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7