CVE-2026-90544
Received Received - Intake

Authenticated Video View Count Manipulation in AVideo

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: VulnCheck

Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the videoAddViewCount.json.php endpoint before updating view statistics. Authenticated attackers can increment view counts and watch-time on videos they cannot access by submitting requests with arbitrary video IDs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-12
Last Modified
2026-09-12
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-90544
EUVD
EUVD-2026-76862

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wwbn avideo to c3edcc274c389816d434acadac07ee78eaf330c1 (exc)
wwbn avideo *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90544 is a missing authorization vulnerability in WWBN AVideo. The videoAddViewCount.json.php endpoint fails to check if a user has permission to access a video before updating its view count and watch-time statistics. Authenticated attackers can exploit this by submitting requests with arbitrary video IDs, artificially inflating metrics for videos they cannot view.

Detection Guidance

To detect this vulnerability, monitor HTTP requests to the videoAddViewCount.json.php endpoint for unauthorized view count increments. Check server logs for repeated requests with arbitrary video IDs from authenticated users. Look for anomalies in view statistics that do not correlate with actual user access patterns.

Impact Analysis

If you use WWBN AVideo, attackers could manipulate video analytics by inflating view counts and watch-time for restricted or private videos. This could lead to inaccurate performance metrics, misleading content popularity data, and potential misuse of video access controls. The impact is limited to authenticated users but does not allow unauthorized access to video content itself.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling unauthorized manipulation of video view statistics. Skewed analytics may lead to incorrect reporting of content access, potentially violating data integrity requirements under these regulations. However, the primary issue is a missing authorization flaw rather than a direct privacy violation.

Mitigation Strategies

Immediately update AVideo to the latest version beyond commit c3edcc274c389816d434acadac07ee78eaf330c1. If no patch is available, restrict access to the videoAddViewCount.json.php endpoint by implementing proper authorization checks. Temporarily disable the endpoint if necessary until a fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90544. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart