CVE-2026-85157
Received Received - Intake

Unauthenticated Video Enumeration in AVideo via RSS Feed

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a program_id parameter is supplied. Attackers can enumerate playlist identifiers and retrieve unlisted and group-restricted videos by requesting the RSS feed with any visible playlist id, including empty playlists that return the entire site's hidden video catalogue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85157
EUVD
EUVD-2026-70392

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wwbn avideo to 29.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

WWBN AVideo has a broken access control flaw in the unauthenticated feed/index.php endpoint. When the program_id parameter is provided, it disables per-video visibility checks. Attackers can exploit this by requesting the RSS feed with any visible playlist ID, including empty ones, to enumerate playlists and access unlisted or group-restricted videos, potentially exposing the entire hidden video catalog.

Detection Guidance

To detect this vulnerability, check if the feed/index.php endpoint responds with sensitive data when accessed with a program_id parameter. Use curl commands like: curl 'http://target.com/feed/index.php?program_id=1' or curl 'http://target.com/feed/index.php?program_id=' to see if unlisted videos are exposed.

Impact Analysis

This vulnerability allows unauthorized users to access videos that should be restricted, such as private or group-only content. Attackers could gather sensitive information, violate privacy, or redistribute restricted media without permission.

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive data, violating GDPR's data protection principles and HIPAA's privacy rules. Organizations may face compliance breaches, legal penalties, and reputational damage due to unauthorized access to restricted content.

Mitigation Strategies

Immediately update AVideo to version 29.1 or later to patch the vulnerability. If an update is not possible, restrict access to the feed/index.php endpoint via server configuration or firewall rules to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85157. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart