CVE-2026-59256: WWBN AVideo Unbound Token Authorization Bypass via Gallery
WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken() creates tokens without binding to user identity or purpose, and plugin/Gallery/view/sections.php issues valid tokens to unauthenticated visitors. Attackers can retrieve a token from the Gallery endpoint and use it to bypass authorization checks in other subsystems like view/hls.php to access restricted video content.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote visitor who can reach the Gallery endpoint can obtain a valid token. No account, privileges, or user interaction are required.
What access can an attacker gain with a token obtained from Gallery?
The token can be used to bypass authorization checks in other subsystems, including view/hls.php, to access restricted video content. The available information identifies confidentiality impact only; it does not indicate integrity or availability impact.
Are deployments affected by default?
The issue is exposed when plugin/Gallery/view/sections.php is reachable by unauthenticated visitors, because that endpoint issues valid tokens. The provided information does not state whether Gallery is enabled or publicly accessible by default.
How can I check whether my instance is affected?
Review whether the deployment includes commit 9c39d8c8 or an affected version through that commit, and test whether an unauthenticated request to the Gallery endpoint receives a valid token. Also verify whether that token is accepted by protected endpoints such as view/hls.php.