CVE-2026-90547
Received Received - Intake

Unauthenticated Chapter Name Exposure in AVideo via Bookmark Plugin

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: VulnCheck

Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the Bookmark plugin getBookmarks.json.php endpoint, allowing unauthenticated attackers to read chapter names from password-protected videos. Attackers can query the endpoint with a video ID parameter to retrieve sensitive chapter metadata without authentication or password verification.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-12
Last Modified
2026-09-12
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-90547
EUVD
EUVD-2026-76865

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wwbn avideo to c3edcc274c389816d434acadac07ee78eaf330c1 (exc)
wwbn avideo *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90547 is a missing authorization vulnerability in WWBN AVideo's Bookmark plugin. The getBookmarks.json.php endpoint fails to validate user permissions, allowing unauthenticated attackers to read chapter names from password-protected videos by querying with a video ID parameter.

Detection Guidance

To detect this vulnerability, check if the Bookmark plugin's getBookmarks.json.php endpoint is accessible without authentication. Send a GET request to /Bookmark/getBookmarks.json.php?videos_id=123 where 123 is a valid video ID. If chapter names from password-protected videos are returned without credentials, the system is vulnerable.

Impact Analysis

Unauthenticated attackers can access sensitive chapter metadata from protected videos without credentials. This exposes private content details, potentially leading to information leaks or further exploitation of video content.

Compliance Impact

This vulnerability allows unauthenticated attackers to read chapter names from password-protected videos, exposing sensitive metadata without proper authorization. This could violate data protection requirements under GDPR and HIPAA by enabling unauthorized access to protected content, potentially leading to non-compliance with confidentiality and access control mandates.

Mitigation Strategies

Immediately disable the Bookmark plugin if not in use. If the plugin is required, update to the latest version beyond commit c3edcc274c389816d434acadac07ee78eaf330c1. Implement proper authorization checks in the getBookmarks.json.php endpoint to verify user permissions before returning sensitive data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90547. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart