Executive brief
WWBN AVideo is a video hosting and streaming platform. A missing authorization check in the PlayerSkins plugin allows unauthenticated attackers to access sensitive metadata from password-protected videos, including titles and owner email addresses, bypassing the password protection entirely.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the PlayerSkins/mediaSession.json.php endpoint. The endpoint calls getMediaSession() without verifying user authentication or invoking User::canWatchVideo() checks, allowing any unauthenticated attacker to submit a videos_id parameter and retrieve sensitive metadata including video title and owner identification (email address). The vulnerable endpoint is accessible over the network with no authentication required. An attacker can enumerate video IDs to extract information about password-protected videos that should not be publicly accessible. No patch has been released at the time of reporting.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-28: disclosed: GitHub Security Advisory GHSA-g79r-wg9m-3fh3 published
- 2026-09-12: advisory: CVE-2026-90550 assigned and published on NVD