Executive brief
WWBN AVideo is a self-hosted video platform used for sharing and managing video content. An authenticated user can artificially inflate view counts and watch-time statistics on videos they are not permitted to access by submitting requests with arbitrary video IDs. This allows users to manipulate analytics data and metrics on restricted content.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the videoAddViewCount.json.php endpoint. The endpoint accepts a video ID parameter and calls VideoStatistic::updateStatistic() to increment view counts and watch-time without first verifying that the authenticated user has permission to watch the target video using User::canWatchVideo(). An authenticated attacker can forge POST requests to this endpoint with arbitrary video IDs to increment statistics on videos they cannot access. The attack requires valid authentication but no special privileges, and can be exploited remotely without user interaction. As of the advisory date, no patch was available.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-28: disclosed: GitHub Security Advisory GHSA-2fgr-549m-8g5w published
- 2026-09-12: advisory: CVE-2026-90544 assigned and published to NVD