CVE-2026-58002: WWBN AVideo Authorization Bypass via Users_affiliations add.json.php
WWBN AVideo through commit 9c39d8c8b4c1f75540788d6b391740852ceb0732 contains an authorization bypass vulnerability in the Usersaffiliations add.json.php endpoint that allows authenticated users to forge two-party consent records by supplying the counterparty's agreement timestamp. Attackers can create a forged affiliation with status='a' and then reassign video ownership to arbitrary users through the videoAddNew.json.php endpoint, which trusts the forged affiliation as an authorization term.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be an authenticated user. No user interaction is required, and the attack can be performed over the network.
What can an attacker do after forging an affiliation record?
They can create an affiliation with accepted status by supplying the other party's agreement timestamp, then use that forged affiliation to reassign video ownership to arbitrary users through videoAddNew.json.php.
How can defenders identify potential exploitation?
Review Users_affiliations add.json.php activity for affiliation records created with status='a' where the counterparty agreement timestamp may have been attacker-supplied. Investigate subsequent videoAddNew.json.php requests that reassign video ownership using those affiliations.