Executive brief
WWBN AVideo is a video hosting and management platform used to share and monetize video content. An authorization flaw in the adsInfo API endpoint allows unauthenticated attackers to retrieve sensitive information about password-protected videos, including the video owner's user ID and personalized advertising URLs. This leaks information that should only be accessible to authorized users, potentially exposing user identities and advertising data.
Technical details
The vulnerability is a missing authorization check (CWE-862) and information exposure (CWE-200) in plugin/API/API.php's get_api_adsInfo function. When the videos_id parameter is provided, the API retrieves the video owner's user ID via Video::getOwner() and returns personalized ad URLs via ADs::getAds() without first calling User::canWatchVideo() to verify the requester has permission. The vulnerable endpoint is accessible over the network without authentication, allowing any unauthenticated attacker to map password-protected videos to their owners and retrieve owner-specific advertising creatives. No patch has been released as of the advisory date.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-28: disclosed: GitHub Security Advisory (GHSA-989c-frwf-gprj) published
- 2026-09-12: advisory: Public advisory CVE-2026-90536 published on NVD