Weak Cryptography in Account Activation Code Generation

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairing codes. getRandomCode() in objects/functions.php derives the code entirely from uniqid() (sprintf('%08x%05x', seconds, microseconds)) with a single non-CSPRNG rand() character used only as padding, reducing the code space to roughly 36 x 10^6 (~2^25) values for a known generation second. Because plugin/API/set.json.php?APIName=login_code can be called without authentication, it also serves as an oracle for the server's exact microtime. An unauthenticated remote attacker who guesses a valid, unexpired code (codes expire after 10 minutes) can redeem it at plugin/API/get.json.php?APIName=login_code to obtain the target account's email address and a User::getUserHash(users_id, '+1 year') value, a credential accepted in place of the account password for one year, resulting in account takeover. No patched version is availa

Casky was already ahead

This CVE exploits attack patterns that Casky's 233matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1 contain a critical cryptographic weakness in their account activation and login pairing code generation mechanism. The getRandomCode() function in objects/functions.php relies on PHP's uniqid() function—which generates predictable values based on system time (seconds and microseconds)—combined with a single non-cryptographically secure rand() character for padding. This reduces the effective keyspace to approximately 2^25 possible values per second, making activation codes trivially brute-forceable. An attacker with knowledge of the approximate generation timestamp can enumerate valid codes in seconds, enabling account takeover, unauthorized API access, and lateral movement within affected deployments. Any organization running AVideo for user management, content delivery, or API authentication is at risk.

Casky's 233 mapped skills detect the attack patterns associated with this vulnerability through MITRE ATT&CK technique TA0006 (Credential Access). When enabled with Claude's extended reasoning, practitioners will observe findings indicating: (1) detection of weak pseudo-random number generation patterns in authentication token generation logs, (2) identification of time-predictable activation code creation sequences across user provisioning events, (3) recognition of brute-force patterns against account activation endpoints that succeed at statistically impossible rates, and (4) correlation of rapid code enumeration attempts with successful account creation events. Practitioners examining their Casky findings will see detailed reasoning chains explaining why activation codes fail entropy validation, how microsecond-level timing data makes codes guessable, and which user accounts were likely compromised through code prediction rather than credential compromise—enabling swift incident response and targeted credential rotation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

233 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-92913.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0006

Investigate the attack patterns behind CVE-2026-92913

Casky has 233 skills that investigate the attack patterns behind CVE-2026-92913. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn