NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · Composer (PHP)

CVE-2023-49599: WWBN AVideo Insufficient Entropy vulnerbaility

criticalCVSS 3.1 9.8GHSA-wqcc-qf63-c2x4

An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HTTP requests can lead to privilege escalation. An attacker can gather system information via HTTP requests and bruteforce the salt offline, leading to forging a legitimate password recovery code for the admin user.

Published Jan 10, 2024 · Updated Nov 4, 2025

Affected packages

wwbn/avideo

Ecosystem
Composer (PHP)
Affected
<= 12.4
Fixed in
No patched version yet
Check
composer show wwbn/avideo

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HTTP requests can lead to privilege escalation. An attacker can gather system information via HTTP requests and bruteforce the salt offline, leading to forging a legitimate password recovery code for the admin user.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Composer (PHP) vulnerabilities

All Composer (PHP) entries