CVE-2026-85157: Exposure of Sensitive Information to an Unauthorized Actor in WWBN AVideo

CVE-2026-85157 describes a broken access control vulnerability in WWBN AVideo's unauthenticated feed/index.php endpoint. The flaw disables per-video visibility checks when a program_id parameter is provided, enabling attackers to enumerate playlist identifiers and retrieve videos that are unlisted or restricted to groups. By requesting the RSS feed with any visible playlist ID, including empty playlists, attackers can access the entire site's hidden video catalog. There is no vendor-provided remediation or patch information available at this time.

Attackers can bypass intended access controls to enumerate and access unlisted and group-restricted videos, potentially exposing sensitive or private video content without authentication. This exposure could lead to unauthorized disclosure of sensitive information contained in hidden videos.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the feed/index.php endpoint or monitor for suspicious requests involving the program_id parameter. Consider implementing additional access controls or authentication mechanisms to protect video visibility.