CVE-2026-86190
Received Received - Intake

Broken Access Control in WWBN AVideo Exposes User Data

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: VulnCheck

Description
WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session identifier to hijack viewer sessions, including administrator accounts, and obtain sensitive personal data for all video viewers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-86190
EUVD
EUVD-2026-72011

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wwbn avideo 29.0
wwbn avideo to 29.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86190 is a broken access control vulnerability in WWBN AVideo affecting versions 29.0 and earlier. It exists in videoViewsInfo endpoints where providing a hash parameter allows unauthenticated attackers to retrieve complete user records including password hashes, recovery tokens, and live session identifiers. This flaw enables session hijacking and exposure of sensitive personal data for all video viewers.

Detection Guidance

Check if your AVideo instance has endpoints like view/videoViewsInfo.json.php, .csv.php, or .php accessible without authentication. Use curl to test: curl -k 'http://<target>/view/videoViewsInfo.json.php?hash=<test_hash>' and verify if sensitive data like password hashes or session IDs is returned.

Impact Analysis

Attackers can hijack viewer sessions, including administrator accounts, by using disclosed session identifiers. This allows unauthorized access to sensitive personal data of all video viewers, including credentials and recovery tokens. The vulnerability enables full account takeover and potential data breaches.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and HIPAA if health-related video data is exposed. It results in unauthorized data disclosure, lack of access controls, and insufficient protection of sensitive information, leading to compliance violations and potential legal consequences.

Mitigation Strategies

Immediately update AVideo to the latest version (30.0 or later) to patch the broken access control. If an update is not possible, restrict access to the vulnerable endpoints via firewall rules or disable them entirely. Rotate all exposed credentials and session tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86190. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart