Unauthenticated Video Metadata Exposure in AVideo

Executive Summary

CVE-2026-90550 is a vulnerability in WWBN AVideo where the PlayerSkins mediaSession.json.php endpoint fails to check user authorization before returning video metadata. Unauthenticated attackers can request this endpoint with a video ID to retrieve titles of password-protected videos and owner email addresses without authentication.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the PlayerSkins/mediaSession.json.php endpoint is accessible without authentication. Use curl to request video metadata with a video ID parameter. Example: curl -v 'http://<target>/PlayerSkins/mediaSession.json.php?videoId=1'. If the response includes sensitive data like video titles or owner emails without requiring credentials, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to access sensitive video metadata, including titles of password-protected videos and owner email addresses, without authentication. This could lead to unauthorized disclosure of private or confidential information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR and HIPAA by exposing sensitive personal data (such as email addresses and video titles) without proper authorization, potentially violating privacy requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update WWBN AVideo to the latest patched version if available. If no patch exists, restrict access to the mediaSession.json.php endpoint via web server rules (e.g., Apache/Nginx access controls). Disable direct access to the endpoint or implement authentication checks in the application code. Monitor logs for unauthorized access attempts to the endpoint.

Useful 0 Not Useful 0