CVE-2026-90545: WWBN AVideo Missing Authorization via commentAddNew.json.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the commentAddNew.json.php endpoint, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests with a valid session to add comments to videos they cannot watch, bypassing password and group access controls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WWBN AVideoto a version that resolves this vulnerability.Patch commit c3edcc274c389816d434acadac07ee78eaf330c1 - Compensating control
As a compensating control, ensure the commentAddNew.json.php endpoint validates video access permissions server-side for password-protected and group-restricted videos before accepting comment POST requests.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated AVideo user with a valid session can exploit it. The attacker does not need permission to view the targeted password-protected or group-restricted video.
What does successful exploitation allow?
An attacker can send a POST request to commentAddNew.json.php and add comments to videos that should be restricted by password or group access controls. The provided severity vector indicates integrity impact only, with no stated confidentiality or availability impact.
Are publicly accessible videos the only affected content?
No. The issue specifically affects the ability to comment on password-protected and group-restricted videos without having the required viewing access.
How can administrators determine whether they are affected?
Assess whether the deployed WWBN AVideo code includes the affected commentAddNew.json.php behavior described through commit c3edcc274c389816d434acadac07ee78eaf330c1. A practical validation is to test, using a non-privileged authenticated account, whether a comment can be submitted to a password-protected or group-restricted video that account cannot watch.