CVE-2026-86190: WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter
Published Sep 5, 2026
·Updated
WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session identifier to hijack viewer sessions, including administrator accounts, and obtain sensitive personal data for all video viewers.
Affected Software
1 affected component
AVideo
Event History
Sep 5, 2026
CVE Published
via MITRE·12:09 PM
Data Sourced
via MITRE·12:09 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require an account or user interaction?
No. The vulnerability is reachable by unauthenticated callers, and the supplied vector indicates network access with low attack complexity and no user interaction.
2
Can this expose or compromise administrator sessions?
Yes. The disclosed live session identifiers can be used to hijack viewer sessions, including administrator accounts.