CVE-2026-90551: WWBN AVideo Missing Authorization via video_from_program API
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the videofromprogram API endpoint, allowing unauthenticated access to private playlist contents. Attackers can query the API without authentication to enumerate private playlist names, owner information, and video titles including password-protected content.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can reach the video_from_program API endpoint can query it. No credentials or user interaction are required.
What information can be exposed?
The endpoint can reveal private playlist names, playlist owner information, and video titles. This includes titles associated with password-protected content.
Are playlist videos themselves disclosed by this issue?
The available information identifies exposure of playlist metadata and video titles, not direct access to the underlying video content.
How can administrators determine whether they are affected?
The issue affects WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1. Administrators should compare their deployed source revision with that commit and test whether video_from_program returns private playlist information without authentication.