Executive brief
WWBN AVideo is a video platform that allows viewers to watch content. A broken access control flaw in the video statistics endpoints allows unauthenticated attackers to retrieve sensitive viewer data including password hashes, recovery tokens, and live session identifiers. By exploiting this, attackers can hijack user sessions—including those of administrators—to gain full account control and access all stored personal information about video viewers.
Technical details
The vulnerability is a broken access control flaw (CWE-200) in the videoViewsInfo endpoints (view/videoViewsInfo.json.php, .csv.php, and .php). When the hash parameter is provided, the application skips the permission check entirely and returns the complete joined users record from the database for every viewer, including password, recoverPass, email, phone, address, birth_date, isAdmin, and session_id fields. The session_id field contains the actual PHP session identifier (from session_id()), and the session cookie name is deterministically derived from md5($global['systemRootPath']), which is disclosed to every visitor in Set-Cookie headers. An unauthenticated attacker can retrieve viewer statistics with a known video_id_hash, extract a victim's session identifier, and replay it under the correct cookie name to assume that user's identity. No patched version is currently available (as of the advisory date).
Affected products
- WWBN AVideo 29.0 and earlier
Timeline
- 2026-08-21: disclosed: GitHub Security Advisory GHSA-82q2-88mq-p44q published
- 2026-09-05: advisory: CVE-2026-86190 and NVD record published