CVE-2026-90536
Received Received - Intake

Unauthenticated Access to Owner IDs in AVideo via adsInfo API

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: VulnCheck

Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to authorize access to the adsInfo API endpoint, allowing unauthenticated attackers to retrieve password-protected video owner identifiers. Attackers can call the adsInfo API with a videos_id parameter to obtain the owner's user ID and personalized ad creative URLs without authentication or permission checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-12
Last Modified
2026-09-12
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-90536
EUVD
EUVD-2026-76854

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wwbn avideo to c3edcc274c389816d434acadac07ee78eaf330c1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in WWBN AVideo allows unauthenticated attackers to access sensitive information through the adsInfo API endpoint. By sending a GET request with a videos_id parameter, attackers can retrieve the owner's user ID and personalized ad creative URLs for password-protected videos without proper authorization checks.

Detection Guidance

To detect this vulnerability, check if your AVideo instance allows unauthenticated access to the adsInfo API endpoint. Send a GET request to /plugin/API/get.json.php?videos_id=1 and verify if it returns sensitive data like owner user IDs or ad URLs without authentication.

Impact Analysis

Unauthenticated attackers can map password-protected videos to their owners and access personalized ad content. This may lead to privacy breaches, unauthorized data exposure, and potential misuse of user information associated with the videos.

Compliance Impact

This vulnerability could violate GDPR and HIPAA by exposing sensitive user data without authorization. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Unauthorized access risks non-compliance with these regulations.

Mitigation Strategies

Immediately restrict access to the adsInfo API endpoint by implementing authentication checks. Update to the latest version of AVideo if a patch is available. If no patch exists, consider disabling the adsInfo API endpoint or applying network-level restrictions to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90536. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart