PGP Second Factor Authentication Bypass via Loose Equality

AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against an uninitialized session variable. Attackers with a victim's password can bypass the second factor by sending a parameter-less GET request to verifyChallenge.json.php, which evaluates null == null and marks authentication complete.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

AVideo LoginControl contains a critical authentication bypass vulnerability in its PGP second factor verification mechanism. The flaw stems from loose equality comparison (== instead of ===) between challenge responses and an uninitialized session variable, allowing attackers who possess a victim's password to completely circumvent the second factor authentication. By sending a parameter-less GET request to verifyChallenge.json.php, an attacker triggers a null == null comparison that evaluates to true, marking authentication as complete. This vulnerability (CWE-287: Improper Authentication) affects any organization deploying AVideo LoginControl, particularly those relying on it for media management and streaming services. The CVSS score of 8.1 reflects the high severity—attackers need only the primary password, not the second factor secret, to gain full account access.

Casky's 283 matching skills leverage Claude's extended reasoning to detect the behavioral patterns underlying this attack chain. The vulnerability maps to TA0004 (Privilege Escalation) and TA0006 (Credential Access), enabling practitioners to identify reconnaissance for credential harvesting followed by authentication bypass attempts. Security teams using Casky would observe findings flagging suspicious verifyChallenge.json.php requests lacking expected parameters, anomalous authentication flows where second factor validation is skipped, and session state anomalies where unauthenticated requests succeed. The platform's skills correlate these indicators with CWE-287 misconfigurations, revealing that loose equality comparisons in authentication logic create exploitable race conditions and state confusion. Practitioners gain actionable intelligence to validate proper strict equality usage (===), enforce non-null session initialization, and implement rate limiting on authentication endpoints before attackers weaponize this pattern.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-92914.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-92914

Casky has 283 skills that investigate the attack patterns behind CVE-2026-92914. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn