CVE-2026-85157: WWBN AVideo Broken Access Control via feed/index.php program_id
WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a programid parameter is supplied. Attackers can enumerate playlist identifiers and retrieve unlisted and group-restricted videos by requesting the RSS feed with any visible playlist id, including empty playlists that return the entire site's hidden video catalogue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate the broken access control by preventing unauthenticated access to the AVideo feed/index.php endpoint with a user-supplied program_id parameter (e.g., block or require authentication/authorization for requests that include program_id).
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any AVideo deployment with the unauthenticated feed/index.php endpoint reachable is exposed to unauthenticated retrieval of unlisted and group-restricted videos when the vulnerable parameter handling is present.
What does an attacker need to exploit it?
No authentication or user interaction is required. An attacker needs to request the RSS feed with a program_id value corresponding to a visible playlist identifier; an empty visible playlist can return the site's hidden video catalogue.
How can defenders determine whether restricted videos may already be exposed?
Review requests to feed/index.php that include the program_id parameter, particularly requests using playlist identifiers. Test whether a request using a visible or empty playlist ID returns videos that should be unlisted or restricted to a group.