CVE-2026-84483Medium· 5.3▾ Sunlit

WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using the public site URL and current time

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score29/ 100 · Low

impact 29.2 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Sep 1, 2026

Updated

Sep 8, 2026

CVSS

5.3

Vendor

—

Product

—

CWE

CWE-321

Depth score

29 · Low

EPSS

0.45% · p39

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Sep 8.

0.3% → 0.4%▲ 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 24 days

Sep 1, 2026Published
Disclosed via NVD
Sep 8, 2026Record revised
Last analysed / modified upstream
Sep 8, 2026EPSS first tracked
0.3%
Sep 25, 2026EPSS peak
0.3% → 0.4%

CWE-321 #nvd

Full technical detail▾

Overview

WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using the public site URL and current time. Attackers can forge authentication tokens by computing hash_hmac with the site's base URL as the key and submit arbitrary passwords to receive encrypted hashes, enabling offline precomputation attacks against stolen password databases.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed