CVE-2026-90549: WWBN AVideo Missing Authorization via videosAndroid.json.php Endpoint
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to properly authorize access to the videosAndroid.json.php endpoint, allowing unauthenticated guests to list password-protected videos with sensitive owner information. Attackers can retrieve video metadata including owner email, lastLogin, filename, and hashId by sending an unauthenticated GET request to the endpoint.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote user can exploit it. No credentials or user interaction are required; the attacker only needs to send a GET request to the affected endpoint.
What information can be exposed?
The endpoint can list password-protected videos and disclose associated metadata, including the video owner’s email address, lastLogin value, filename, and hashId.
Are password-protected videos sufficient to prevent this disclosure?
No. The affected endpoint can expose listings and metadata for password-protected videos to unauthenticated guests.
How can I check whether an instance is affected?
Test whether an unauthenticated GET request to videosAndroid.json.php returns video listings or metadata such as owner email, lastLogin, filename, or hashId. The issue is reported in WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1.