CVE-2026-90544: WWBN AVideo Missing Authorization via videoAddViewCount.json.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the videoAddViewCount.json.php endpoint before updating view statistics. Authenticated attackers can increment view counts and watch-time on videos they cannot access by submitting requests with arbitrary video IDs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WWBN AVideoto a version that resolves this vulnerability.Patch c3edcc274c389816d434acadac07ee78eaf330c1 - Compensating control
Restrict access to the WWBN AVideo videoAddViewCount.json.php endpoint so only authenticated users who are authorized to view the specific video ID can submit view-count/watch-time update requests.
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker must be authenticated. No user interaction is required, and exploitation can be performed over the network.
What can an attacker change through this issue?
An authenticated attacker can submit arbitrary video IDs to the affected endpoint and increase view counts and watch-time statistics for videos they are not authorized to access. The available information indicates an integrity impact only.
How can administrators determine whether their deployment is affected?
Deployments of WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 are affected. Review the deployed source revision and determine whether videoAddViewCount.json.php validates access permissions before updating video statistics.