Executive brief
WWBN AVideo is an open-source platform used for hosting and sharing video content. A flaw in the video processing system allows users with upload permissions to bypass administrative moderation and review workflows. By manipulating a specific request parameter, an uploader can force their video to be immediately 'active' and publicly visible, potentially allowing the distribution of prohibited or unvetted content.
Technical details
An improper authorization vulnerability (CWE-285) exists in WWBN AVideo versions 26.0 and prior within the video processing pipeline. The `setStatus()` method in `objects/video.php` accepts an `overrideStatus` request parameter and applies it without verifying if the user has the necessary permissions to change a video's state. While the method validates that the status code is a known value (e.g., 'a' for active), it fails to restrict this functionality to administrators. An attacker with low-privileged uploader access can send a crafted POST request to `videoAddNew.json.php` or `aVideoEncoder.json.php` to bypass moderation queues and publish videos directly. As of the advisory date, no official patches are available.
Affected products
- WWBN AVideo <= 26.0
Timeline
- 2026-03-30: advisory: GitHub Security Advisory published by vendor
- 2026-03-31: disclosed: CVE-2026-34738 published to NVD