CVE-2023-49599: WWBN AVideo Insufficient Entropy vulnerbaility

January 10, 2024 (updated November 4, 2025)

An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HTTP requests can lead to privilege escalation. An attacker can gather system information via HTTP requests and bruteforce the salt offline, leading to forging a legitimate password recovery code for the admin user.

References

github.com/WWBN/AVideo
github.com/WWBN/AVideo/commit/15fed957fb64b4055158acfc449bd7974346edb5
github.com/advisories/GHSA-wqcc-qf63-c2x4
nvd.nist.gov/vuln/detail/CVE-2023-49599
talosintelligence.com/vulnerability_reports/TALOS-2023-1900

Code Behaviors & Features

Detect and mitigate CVE-2023-49599 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →