CVE-2026-92913 is a weak randomness flaw in AVideo, in the code that creates account activation and login pairing codes. The codes are guessable, which can lead to account takeover. NVD scores it High (7.4). VulnCheck and the project advisory both say no patched version exists.
What's affected
The GitHub advisory and the NVD record list AVideo up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1 as affected. The advisory lists patched versions as none, and VulnCheck says the same. Check the project repository for newer commits or releases and what they change.
The weakness is CWE-330, use of insufficiently random values. The vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N: network reachable, no login, but high complexity because a valid code must be guessed within its short life.
The advisory says the generator is built from the clock and a non-cryptographic random call used only as padding. That shrinks the space of possible codes to roughly 2 to the power of 25 for a known second, far smaller than an eight character code suggests. Codes expire after 10 minutes. Redeeming a valid code returns a credential that the advisory says is accepted in place of the password for one year.
How to check if you're exposed
Find which AVideo commit or release you run and compare it with the affected commit. Because there is no patched version, everything up to that commit is exposed, and a newer one needs checking against the repository.
Then check whether the login pairing or activation feature is reachable from the internet, and look at your access logs for bursts of requests to the code redemption endpoints. A large number of failed attempts from one address is a sign of guessing.
Paste a lockfile or SBOM into the free in-browser dependency scan to see whether this package is in your tree, including as a transitive dependency. Safeguard's reachability analysis can then show whether your code actually calls the affected path, which helps you order the work.
What to do now
- Check the AVideo repository for a commit that replaces the code generator with a cryptographically secure one, and update to it when it exists.
- Rate limit and monitor the login code endpoints at your reverse proxy.
- Disable the login pairing feature if you do not use it, where your setup allows.
- If you suspect misuse, reset passwords on affected accounts and invalidate long-lived credentials.
- Block or restrict access to the code endpoints from the public internet if the feature is only needed internally.
Why it matters
Pairing and activation codes are short-lived credentials, and their security rests entirely on being unpredictable. Using the system clock as the main source of the value makes it predictable to anyone who can estimate the time, and the advisory notes that one unauthenticated endpoint also reveals the server's exact time to the microsecond.
The fix for this class of bug is to draw codes from a cryptographically secure random source and make them long enough, then rate limit redemption. The KEV flag in the record is false and neither source reports exploitation.
Quick check
Is there a patch?
The advisory and VulnCheck both say no patched version is available. Check the repository for newer commits.
Why is the score not higher?
The vector marks attack complexity as high, because a valid code must be guessed during its 10 minute life.
Sources
Last reviewed: 18 October 2026.
