critical
CVE-2026-18072
ARVE hardcoded-backdoor authentication bypass -> admin takeover (malicious release)
- Severity
- critical
- Affected product
- advanced-responsive-video-embedder
- Affected versions
- advanced-responsive-video-embedder ≥ 10.8.7, ≤ 10.8.7
- Fixed in
- advanced-responsive-video-embedder any release other than 10.8.7
- Detection basis
- Component version range
- Shipped rule
- advanced-responsive-video-embedder: ARVE hardcoded-backdoor authentication bypass -> admin takeover (malicious release)
- Added to NewScan
- 2026-07-29
- Detected by
- NewScan — free, self-hosted
How NewScan reports it
COMPONENT VERSION RANGE
NewScan fingerprints advanced-responsive-video-embedder from its response and reports this CVE when the detected version falls inside the affected range below.
Hardcoded backdoor shipped in ONE release by an attacker with commit access. The exact-version pin (ge == le) is CORRECT here: every other release is clean.
References
Scan for this yourself — local, in-band scanning is free.
Get NewScan (FREE) →Review the measured benchmark, then use the verified remediation process.