CVE-2026-92914
AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against an uninitialized session variable. Attackers with a victim's password can bypass the second factor by sending a parameter-less GET request to verifyChallenge.json.php, which evaluates null == null and marks authentication complete.
- Published Sep 17, 2026
- CVSS 8.6 high
- 0.5% chance of exploitation in the next 30 days (EPSS)