CVE-2026-86190: Exposure of Sensitive Information to an Unauthorized Actor in WWBN AVideo

CVE-2026-86190 describes a broken access control vulnerability in WWBN AVideo's videoViewsInfo endpoints. When an unauthenticated caller provides a hash parameter, the endpoint returns full user records containing sensitive information such as password hashes, recovery tokens, and live session identifiers. The disclosed session identifiers can be used by attackers to hijack active viewer sessions, including those of administrators, thereby compromising account integrity and exposing personal data of all video viewers. The vulnerability affects versions from 0 up to and including 29.0. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality and integrity.

Attackers can access sensitive user data without authentication, including password hashes and recovery tokens, enabling potential credential compromise. They can hijack live sessions of viewers and administrators, leading to unauthorized access and control over accounts and exposure of personal data for all video viewers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the videoViewsInfo endpoints and monitor for suspicious activity related to session hijacking attempts.