CVE-2026-85156
Received Received - Intake

Unauthenticated Access to Private Videos in WWBN AVideo

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through hardcoded visibility flags and an undefined property. Attackers can access the channel endpoint to retrieve sensitive video content that should be hidden, including full URLs to unlisted videos and thumbnails of member-only content, regardless of the operator's hidePrivateVideos setting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85156
EUVD
EUVD-2026-70391

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wwbn avideo *
wwbn avideo to 29.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

WWBN AVideo has an access control flaw where unauthenticated users can view unlisted or group-restricted videos by accessing the public channel page. The system fails to validate visibility settings properly, exposing sensitive content through hardcoded flags and undefined properties.

Detection Guidance

Check if unauthenticated users can access the channel endpoint by attempting to retrieve video listings or specific video URLs directly. Use tools like curl to query the channel page or video endpoints without authentication. Example: curl -v http://<target>/objects/channel.php?user=<username>

Impact Analysis

Attackers can retrieve hidden videos, including full URLs and thumbnails of private content, bypassing intended access restrictions. This may lead to unauthorized access to sensitive or proprietary information.

Mitigation Strategies

Update AVideo to the latest patched version if available. Restrict access to the channel endpoint by implementing proper authentication and authorization checks. Review and remove hardcoded visibility flags that allow unauthorized access to unlisted or private videos.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85156. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart