CVE-2026-90545: Missing Authorization in WWBN AVideo
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the commentAddNew.json.php endpoint, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests with a valid session to add comments to videos they cannot watch, bypassing password and group access controls.
AI Analysis
Technical Summary
WWBN AVideo, as of commit c3edcc274c389816d434acadac07ee78eaf330c1, does not validate whether an authenticated user has permission to access a video before allowing them to add comments via the commentAddNew.json.php endpoint. This missing authorization check enables users with valid sessions to submit POST requests to add comments on videos they are not authorized to watch due to password protection or group restrictions.
Potential Impact
Authenticated users can bypass password and group-based access controls to post comments on restricted videos. This could lead to unauthorized content interaction and potential information disclosure about restricted videos through comment metadata, but does not grant viewing access to the video content itself.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict commenting functionality to trusted users or disable commenting on restricted videos as a temporary mitigation.
CVE-2026-90545: Missing Authorization in WWBN AVideo
Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the commentAddNew.json.php endpoint, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests with a valid session to add comments to videos they cannot watch, bypassing password and group access controls.
CVSS v4.0
Score 5.3medium
Affected software
WWBN
AVideo
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
WWBN AVideo, as of commit c3edcc274c389816d434acadac07ee78eaf330c1, does not validate whether an authenticated user has permission to access a video before allowing them to add comments via the commentAddNew.json.php endpoint. This missing authorization check enables users with valid sessions to submit POST requests to add comments on videos they are not authorized to watch due to password protection or group restrictions.
Potential Impact
Authenticated users can bypass password and group-based access controls to post comments on restricted videos. This could lead to unauthorized content interaction and potential information disclosure about restricted videos through comment metadata, but does not grant viewing access to the video content itself.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict commenting functionality to trusted users or disable commenting on restricted videos as a temporary mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-12T11:13:17.618Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa5465255bf5e2cf54629da
Added to database: 09/12/2026, 12:32:18 UTC
Last enriched: 09/12/2026, 12:48:45 UTC
Last updated: 09/13/2026, 00:47:19 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.