Authorization Bypass in AVideo via Unbound Tokens

Executive Summary

CVE-2026-59256 is an authorization bypass vulnerability in WWBN AVideo where the getToken() function creates tokens without binding them to user identity or purpose. The plugin/Gallery/view/sections.php endpoint issues valid tokens to unauthenticated visitors. Attackers can retrieve these tokens and use them to bypass authorization checks in other parts of the application, such as accessing restricted video content.

Useful 0 Not Useful 0

Detection Guidance

Check if the Gallery plugin's sections.php endpoint is accessible without authentication by sending a GET request to /plugin/Gallery/view/sections.php. If it returns a valid token, the system is vulnerable. Example: curl -i http://<target>/plugin/Gallery/view/sections.php

Verify if tokens from the Gallery endpoint can be used to access restricted content like /view/hls.php by appending the token to requests. Example: curl -i http://<target>/view/hls.php?token=<obtained_token>

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized users to access restricted video content by exploiting weak token generation and validation. Attackers can retrieve tokens from an unprotected endpoint and use them to bypass security controls, potentially exposing sensitive information or violating privacy.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Update AVideo to the latest version or apply the official patch to fix token binding and authorization checks.

Restrict access to the Gallery plugin's sections.php endpoint by implementing authentication or removing public access.

Review and update token generation logic to bind tokens to user identities and purposes, ensuring proper validation in verifyToken().

Useful 0 Not Useful 0