CVE-2026-85156: WWBN AVideo Broken Access Control via Channel Page
WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through hardcoded visibility flags and an undefined property. Attackers can access the channel endpoint to retrieve sensitive video content that should be hidden, including full URLs to unlisted videos and thumbnails of member-only content, regardless of the operator's hidePrivateVideos setting.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated visitor who can access the public channel endpoint can retrieve content that should be restricted. No account, privileges, or user interaction are required.
Does enabling hidePrivateVideos prevent exposure?
No. The issue allows access regardless of the operator's hidePrivateVideos setting.
What information may be exposed through the affected endpoint?
The endpoint can disclose full URLs for unlisted videos and thumbnails for member-only content, potentially allowing access to video content intended to be hidden.