WWBN AVideo Watch Permission Bypass in playListAddVideo.json.php

Executive Summary

CVE-2026-90540 is a missing authorization check in WWBN AVideo's playListAddVideo.json.php endpoint. Authenticated attackers can add password-protected videos they cannot watch to their own playlists by submitting video and playlist IDs. The system fails to verify if the user has permission to watch the video before adding it.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect network traffic for POST requests to the playListAddVideo.json.php endpoint containing video ID and playlist ID parameters. Check server logs for unauthorized playlist modifications or attempts to add restricted videos. Verify if the canWatchVideo function is bypassed during playlist additions.

Useful 0 Not Useful 0

Impact Analysis

If you use AVideo with the PlayLists plugin enabled, an attacker with an account could add videos you restricted to their playlist. This could expose sensitive content indirectly or bypass intended access controls. The impact is limited to playlist modifications by authenticated users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance requirements that mandate strict access controls for sensitive data, such as GDPR or HIPAA. Unauthorized playlist modifications might expose restricted content, leading to data breaches or unauthorized access to protected information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update AVideo to the latest commit beyond c3edcc274c389816d434acadac07ee78eaf330c1. Disable the PlayLists plugin if not required. Implement strict input validation for video and playlist IDs in the playListAddVideo.json.php endpoint. Review all playlists for unauthorized video additions and revoke access to suspicious accounts.

Useful 0 Not Useful 0