CVE-2026-90546
Received Received - Intake

WWBN AVideo Like Counter Permission Bypass

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: VulnCheck

Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the like.json.php endpoint, allowing logged-in users to record likes on password-protected and group-restricted videos. Attackers can submit like requests for videos they cannot watch to increment like counters and bypass access controls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-12
Last Modified
2026-09-12
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-90546
EUVD
EUVD-2026-76864

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wwbn avideo to c3edcc274c389816d434acadac07ee78eaf330c1 (exc)
wwbn avideo *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in WWBN AVideo allows logged-in users to record likes on password-protected or group-restricted videos without proper authorization. The like.json.php endpoint fails to validate if a user can watch a video before allowing them to increment its like counter. The system only checks if the user is logged in but does not verify video access permissions.

Detection Guidance

Check for unauthorized like requests in server logs by searching for access to /objects/like.json.php with GET or POST parameters like 'like' and 'videos_id'. Monitor like counters on restricted videos for unexpected increments without corresponding user access.

Impact Analysis

Attackers can manipulate like counters on restricted videos, artificially inflating view counts or popularity metrics. While confidentiality and availability are not directly affected, unauthorized modifications to like counters could skew analytics, mislead users about video popularity, or enable social engineering attacks based on falsified engagement data.

Compliance Impact

This vulnerability does not directly impact GDPR or HIPAA compliance as it does not involve unauthorized access to personal data or protected health information. The issue only allows manipulation of like counters on restricted videos without proper authorization checks.

Mitigation Strategies

Update AVideo to the latest commit or apply a patch that adds permission checks in like.json.php. Ensure the Like class calls User::canWatchVideo() before recording likes. Temporarily disable the like feature if no patch is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90546. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart