Executive brief
WWBN AVideo is a video hosting and streaming platform. A missing authorization check in the like recording endpoint allows logged-in users to increment like counters on videos they cannot access, such as password-protected or group-restricted videos. While the impact is limited to like counter manipulation, it represents a bypass of the platform's access control boundaries and could be used to inject false engagement metrics.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the objects/like.json.php endpoint. The Like class constructor only validates that a user is logged in via User::isLogged(), but does not call User::canWatchVideo() to verify access to the target video. This allows any authenticated user to submit HTTP requests to the like endpoint with video IDs of password-protected or group-restricted videos they cannot normally watch. An attacker can increment like counters and set their vote on videos outside their access scope without triggering the same 403 Forbidden or password challenge that the watch page would return. The vulnerability requires network access and user login credentials; no patch was available at the time of disclosure.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-28: disclosed: GitHub Security Advisory GHSA-5jgf-mc35-5wg5 published
- 2026-09-12: advisory: CVE-2026-90546 assigned and published on NVD