AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId() returns video_id_hash credentials for any video by encoder_queue_id without ownership verification, and useVideoHashOrLogin() converts this hash into passwordless login as the video owner. Attackers with upload permission can retrieve an administrator's video_id_hash by omitting the videos_id parameter, then use that hash in an unauthenticated request to gain administrative session access and modify system configuration.

AVideo through commit 9c39d8c8 contains a critical authentication bypass vulnerability. The function deduplicateByEncoderQueueId() exposes video_id_hash credentials for any video via encoder_queue_id without verifying ownership. The function useVideoHashOrLogin() then converts this hash into a passwordless login session as the video owner. An attacker with basic upload permissions can retrieve an administrator's video_id_hash by omitting the videos_id parameter in a request. This hash can then be used in an unauthenticated request to gain full administrative session access. Once admin access is obtained, the attacker can modify system configuration and potentially compromise the entire platform. The vulnerability chain combines an information disclosure flaw with an insecure authentication mechanism.