CVE-2026-58002: Insufficient Verification of Data Authenticity in WWBN AVideo

WWBN AVideo through commit 9c39d8c8b4c1f75540788d6b391740852ceb0732 contains an authorization bypass vulnerability in the Users_affiliations add.json.php endpoint. The flaw allows authenticated users to supply a forged counterparty agreement timestamp, creating forged two-party consent records with status='a'. This forged affiliation is then trusted by the videoAddNew.json.php endpoint, enabling attackers to reassign video ownership to arbitrary users without proper authorization checks.

An attacker with authenticated access can bypass authorization controls to forge consent records and reassign video ownership to arbitrary users. This could lead to unauthorized control over video content, potentially compromising content integrity and user trust. The vulnerability has a CVSS 4.0 score of 7.1 (high severity), indicating significant impact due to low attack complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to minimize exposure and monitor for suspicious affiliation or ownership changes.