CVE-2026-43875

The CVE describes a vulnerability in WWBN/AVideo where plugin/MobileManager/oauth2.php leaks the user password hash via a GET redirect: it redirects with Location: oauth2Success.php?user=&pass=, and the hash is the stored password hash (md5(hash("whirlpool", sha1(password)))) read from the users ...