CVE-2026-90549
Received Received - Intake

Unauthenticated Access to Password-Protected Videos in WWBN AVideo

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: VulnCheck

Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to properly authorize access to the videosAndroid.json.php endpoint, allowing unauthenticated guests to list password-protected videos with sensitive owner information. Attackers can retrieve video metadata including owner email, lastLogin, filename, and hashId by sending an unauthenticated GET request to the endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-12
Last Modified
2026-09-12
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-90549
EUVD
EUVD-2026-76867

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wwbn avideo to c3edcc274c389816d434acadac07ee78eaf330c1 (inc)
wwbn avideo *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in WWBN AVideo allows unauthenticated users to access a list of password-protected videos and view sensitive owner information by exploiting a missing authorization check in the videosAndroid.json.php endpoint. Attackers can retrieve metadata such as owner email, last login time, filename, and hash ID without authentication.

Detection Guidance

To detect this vulnerability, check if unauthenticated GET requests to the videosAndroid.json.php endpoint return sensitive video metadata. Use curl to test: curl -X GET 'http://<target>/objects/videosAndroid.json.php'. If the response includes owner email, lastLogin, filename, or hashId, the system is vulnerable.

Impact Analysis

Unauthenticated access to sensitive video metadata could lead to privacy breaches, exposure of user identities, or potential misuse of owner information. While actual video content remains protected, attackers may gather intelligence about video owners and their activity.

Compliance Impact

This vulnerability may violate data protection regulations such as GDPR or HIPAA by exposing personally identifiable information (PII) without authorization. Organizations using affected AVideo versions could face compliance violations, legal penalties, and reputational damage due to unauthorized data exposure.

Mitigation Strategies

Immediately restrict access to the videosAndroid.json.php endpoint by implementing proper authorization checks. Update to the latest patched version if available. As a temporary measure, block external access to this endpoint via firewall rules or web server configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90549. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart