CVE-2026-90552
Received Received - Intake

WWBN AVideo Unauthenticated Playlist Schedule Metadata Exposure

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: VulnCheck

Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the Playlists_schedules/list.json.php and Live/calendar.json.php endpoints, allowing authenticated and unauthenticated users to read private playlist schedule metadata. Attackers with canStream privileges or no authentication can retrieve schedule names, descriptions, timestamps, and playlist identifiers by querying these endpoints without ownership checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-12
Last Modified
2026-09-12
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-90552
EUVD
EUVD-2026-76870

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wwbn avideo to c3edcc274c389816d434acadac07ee78eaf330c1 (inc)
wwbn avideo *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90552 is a missing authorization vulnerability in WWBN AVideo where two endpoints, Playlists_schedules/list.json.php and Live/calendar.json.php, fail to validate playlist ownership. This allows both authenticated and unauthenticated users to access private playlist schedule metadata such as titles, descriptions, timestamps, and identifiers without proper permission checks.

Detection Guidance

To detect this vulnerability, check if unauthenticated or authenticated users can access the endpoints Playlists_schedules/list.json.php and Live/calendar.json.php. Use curl commands like curl http://<target>/Playlists_schedules/list.json.php and curl http://<target>/Live/calendar.json.php to see if they return private playlist schedule data without proper access controls.

Impact Analysis

Attackers with canStream privileges or no authentication can retrieve sensitive schedule details, potentially exposing private metadata. This could lead to unauthorized access to confidential information, though the vulnerability does not allow modification or deletion of data.

Compliance Impact

This vulnerability could lead to unauthorized access to private playlist metadata, including schedule names, descriptions, and timestamps. For GDPR, this may violate principles of data minimization and security, potentially exposing personal or sensitive data without consent. For HIPAA, if the metadata includes protected health information, this could result in unauthorized disclosure, violating safeguards for protected data.

Mitigation Strategies

Immediately restrict access to the vulnerable endpoints Playlists_schedules/list.json.php and Live/calendar.json.php by implementing proper authorization checks. Ensure only authorized users can access private playlist metadata. Update to the latest patched version if available or apply temporary access controls until a patch is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90552. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart