CVE-2026-90538
Received Received - Intake

Unauthenticated Access to Private Playlists in AVideo

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: VulnCheck

Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in playlistsFromUser.json.php that allows unauthenticated attackers to read private playlists by requesting another user's identifier. Attackers can retrieve Favorite and Watch Later playlists belonging to other users due to improper cache keying that conflates requests across different user contexts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-12
Last Modified
2026-09-12
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-90538
EUVD
EUVD-2026-76856

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wwbn avideo to c3edcc274c389816d434acadac07ee78eaf330c1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in WWBN AVideo allows unauthenticated attackers to read private playlists belonging to other users by exploiting a missing authorization check in the playlistsFromUser.json.php component. Attackers can retrieve Favorite and Watch Later playlists by providing another user's identifier due to improper cache keying that conflates requests across different user contexts.

Detection Guidance

To detect this vulnerability, check if your AVideo instance exposes the playlistsFromUser.json.php endpoint without proper authorization. Send a request with a users_id parameter to see if private playlists are returned. Example: curl -s 'http://<target>/objects/playlistsFromUser.json.php?users_id=<target_user_id>' and inspect the response for sensitive data.

Impact Analysis

Unauthenticated attackers could access your private playlists, including Favorite and Watch Later lists, by manipulating user identifiers. This could lead to exposure of sensitive viewing habits or preferences. The vulnerability may also allow attackers to poison other playlist APIs, potentially affecting broader system functionality.

Compliance Impact

This vulnerability could violate privacy regulations like GDPR and HIPAA by exposing users' private playlist data without authorization. GDPR requires protecting personal data, while HIPAA mandates safeguarding health-related information. Unauthorized access to such data may result in compliance breaches and legal consequences.

Mitigation Strategies

Immediately restrict access to the playlistsFromUser.json.php endpoint by implementing proper authorization checks. Ensure the endpoint validates user permissions before returning any playlist data. Update to the latest patched version if available. If no patch exists, consider disabling the endpoint or applying a firewall rule to block unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90538. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart