CVE-2026-90547: WWBN AVideo Missing Authorization via getBookmarks.json.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the Bookmark plugin getBookmarks.json.php endpoint, allowing unauthenticated attackers to read chapter names from password-protected videos. Attackers can query the endpoint with a video ID parameter to retrieve sensitive chapter metadata without authentication or password verification.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of WWBN AVideo that use the Bookmark plugin and have password-protected videos may expose chapter names for those videos. The affected endpoint is reachable without authentication.
What does an attacker need to exploit it?
An attacker only needs network access to the affected endpoint and a video ID parameter. No account, user interaction, or video password is required.
What information can be disclosed?
The issue discloses chapter names, which are metadata associated with password-protected videos. The available information does not indicate disclosure of the video password or video contents.