Authorization Bypass in AVideo via Forged Affiliations

Executive Summary

CVE-2026-58002 is an authorization bypass flaw in WWBN AVideo's Users_affiliations add.json.php endpoint. It allows authenticated users to forge two-party consent records by supplying the counterparty's agreement timestamp without their knowledge. The attacker creates a forged affiliation with status 'a' and then reassigns video ownership to arbitrary users through the videoAddNew.json.php endpoint, which trusts the forged affiliation as valid authorization.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the Users_affiliations/add.json.php endpoint for unauthorized modifications to affiliation records. Check for forged consent timestamps in company_agree_date or affiliate_agree_date fields. Review videoAddNew.json.php logs for unexpected ownership reassignments.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to publish unauthorized content under your identity on your channel, potentially causing reputational harm. It bypasses ownership controls and does not require elevated privileges or user interaction beyond the attacker's actions. The impact includes data integrity compromise and unauthorized content attribution.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized content attribution and reputational harm, which may violate data integrity and consent requirements under GDPR and HIPAA. Forged affiliations and video ownership reassignments could result in improper handling of personal or sensitive data, potentially breaching compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict the add.json.php endpoint to only accept fields belonging to the caller. Remove the ability to set counterparty agreement timestamps. Implement proper authorization checks before processing affiliation records. Review and remove any forged affiliations with status 'a'.

Useful 0 Not Useful 0