CVE-2026-90545
Received Received - Intake

Authenticated Comment Posting Bypass in AVideo

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: VulnCheck

Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the commentAddNew.json.php endpoint, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests with a valid session to add comments to videos they cannot watch, bypassing password and group access controls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-12
Last Modified
2026-09-12
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-90545
EUVD
EUVD-2026-76863

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wwbn avideo to c3edcc274c389816d434acadac07ee78eaf330c1 (exc)
wwbn avideo *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90545 is a missing authorization vulnerability in WWBN AVideo where the commentAddNew.json.php endpoint fails to validate video access permissions. Authenticated users can post comments on password-protected or group-restricted videos without proper authorization checks, bypassing access controls.

Detection Guidance

To detect this vulnerability, monitor HTTP POST requests to the commentAddNew.json.php endpoint in WWBN AVideo. Check for comments on videos where the user lacks viewing permissions. Use network logs to identify unauthorized POST requests with valid sessions targeting restricted videos.

Impact Analysis

Attackers with valid sessions can post comments on restricted videos they cannot watch, potentially exposing sensitive information or enabling spam. This undermines content access controls and may lead to unauthorized interactions with protected videos.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by allowing unauthorized access to restricted content through comments, potentially exposing personal or sensitive data without proper consent or access controls.

Mitigation Strategies

Immediately update WWBN AVideo to the latest patched version if available. Temporarily disable commenting features on password-protected or group-restricted videos. Implement stricter access controls in the commentAddNew.json.php endpoint to verify User::canWatchVideo() before allowing comments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90545. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart