Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
AVideo versions up to and including 26.0 have a PGP 2FA weakness in the LoginControl plugin, where the built-in key generator creates 512-bit RSA keys. An attacker who has a target user's public key and the account password could factor the modulus, recover the private key, and decrypt the 2FA challenge to bypass the second factor. The unauthenticated key generation and encryption endpoints can also be used for denial of service. No fixed version is listed.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.4 | High | 3.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0027, the 18th percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:25 UTC First seen by agentprime
- 31 Oct 2026, 14:25 UTC Confirmed by OSV