CVE-2026-90546: WWBN AVideo Missing Authorization via like.json.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the like.json.php endpoint, allowing logged-in users to record likes on password-protected and group-restricted videos. Attackers can submit like requests for videos they cannot watch to increment like counters and bypass access controls.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be logged in to AVideo. They can target password-protected or group-restricted videos even if they do not have permission to watch them.
What is the practical impact of exploitation?
An attacker can submit like requests for inaccessible videos and increment their like counters. The described bypass applies to recording likes; the data does not indicate that it grants video playback access.
How can I determine whether my deployment is affected?
The issue affects WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1. Test whether a logged-in account without access to a password-protected or group-restricted video can successfully send a like request through like.json.php and increase its like count.