CVE-2026-90542: WWBN AVideo Missing Authorization via remindMe.json.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate that logged-in users can access live schedules before creating reminders via remindMe.json.php. Authenticated attackers can create scheduler reminders for private live schedules they cannot view and learn the private schedule title from the generated email job.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as a logged-in user. The attacker does not need permission to view the targeted private live schedule.
What information can be disclosed or changed?
An attacker can create scheduler reminders for private live schedules they cannot access. The generated email job can reveal the title of the private schedule.
Are unauthenticated users affected?
The available information describes exploitation by authenticated attackers, so a logged-in account is required.
How can I determine whether the issue applies to my deployment?
The issue affects WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1. Check whether your deployed code includes that commit or an earlier affected revision, and whether logged-in users can reach remindMe.json.php.