CVE-2026-35179: WWBN AVideo Auth Bypass Vulnerability

CVE-2026-35179 Overview

CVE-2026-35179 is a Missing Authorization vulnerability (CWE-862) affecting WWBN AVideo, an open source video platform. In versions 26.0 and prior, the SocialMediaPublisher plugin exposes a publishInstagram.json.php endpoint that acts as an unauthenticated proxy to the Facebook/Instagram Graph API. The endpoint accepts user-controlled parameters including an access token, container ID, and Instagram account ID, and passes them directly to the Graph API via InstagramUploader::publishMediaIfIsReady(). This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform's own credentials.

Critical Impact

Unauthenticated attackers can leverage the vulnerable endpoint to proxy arbitrary requests to the Facebook/Instagram Graph API, potentially hijacking social media accounts, posting unauthorized content, or exfiltrating sensitive data using stolen or platform-owned credentials.

Affected Products

• WWBN AVideo versions 26.0 and prior
• Installations with SocialMediaPublisher plugin enabled
• Systems exposing the publishInstagram.json.php endpoint

Discovery Timeline

• 2026-04-06 - CVE CVE-2026-35179 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-35179

Vulnerability Analysis

This vulnerability represents a classic case of missing authorization controls combined with server-side request forgery (SSRF)-like behavior. The publishInstagram.json.php endpoint within the SocialMediaPublisher plugin fails to implement any authentication or authorization checks before processing incoming requests.

The core issue stems from the endpoint's design as an open proxy to Facebook's Graph API. When a request arrives, the endpoint extracts user-supplied parameters—including sensitive authentication tokens—and forwards them directly to Instagram's API infrastructure via the InstagramUploader::publishMediaIfIsReady() method. This creates a trust boundary violation where the AVideo server becomes an unwitting intermediary for potentially malicious Graph API interactions.

The vulnerability is particularly concerning because it allows attackers to obscure their origin when making Graph API calls, potentially bypassing IP-based rate limiting or security controls implemented by Facebook/Instagram.

Root Cause

The root cause is a Missing Authorization vulnerability (CWE-862) in the endpoint design. The publishInstagram.json.php file processes requests without verifying that the caller has appropriate permissions or is even an authenticated user of the AVideo platform. The endpoint blindly trusts all incoming parameters and forwards them to the external Graph API, violating the principle of least privilege and failing to implement proper access control mechanisms.

Attack Vector

The attack can be executed remotely over the network without any authentication requirements. An attacker would craft HTTP requests to the vulnerable publishInstagram.json.php endpoint, supplying arbitrary access tokens and account identifiers. The AVideo server then proxies these requests to Facebook's Graph API infrastructure.

Potential attack scenarios include:

1. Token Abuse: Using stolen OAuth access tokens through the proxy to mask the attacker's true origin
2. Credential Hijacking: Attempting to leverage any tokens cached or stored by the AVideo installation
3. API Abuse: Using the server as a proxy to circumvent rate limiting or IP-based restrictions on Graph API access
4. Social Media Account Manipulation: Posting unauthorized content or extracting data from Instagram accounts

For detailed technical information about the vulnerability mechanism, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-35179

Indicators of Compromise

• Unusual HTTP requests to /plugin/SocialMediaPublisher/publishInstagram.json.php from external or untrusted IP addresses
• High volume of requests to the vulnerable endpoint that don't correlate with legitimate publishing activity
• Access logs showing requests with varying access token parameters from the same source
• Unexpected outbound connections from the AVideo server to Facebook Graph API endpoints

Detection Strategies

• Monitor web server access logs for requests targeting publishInstagram.json.php from unauthenticated sessions
• Implement web application firewall (WAF) rules to detect and alert on suspicious parameter patterns in requests to the vulnerable endpoint
• Deploy network monitoring to track outbound connections to graph.facebook.com and correlate with legitimate application behavior
• Review authentication logs for the AVideo platform to identify requests that bypass normal login workflows

Monitoring Recommendations

• Enable verbose logging for the SocialMediaPublisher plugin to capture all incoming requests and parameters
• Configure alerting for any access to the vulnerable endpoint from IP addresses outside trusted administrative ranges
• Implement rate limiting on the endpoint to detect and mitigate automated exploitation attempts
• Monitor for anomalous social media activity on connected Instagram accounts that could indicate unauthorized access

How to Mitigate CVE-2026-35179

Immediate Actions Required

• Disable or remove the SocialMediaPublisher plugin if not actively required for business operations
• Implement access control rules at the web server level to restrict access to publishInstagram.json.php
• Rotate any Instagram/Facebook access tokens that may have been configured in the AVideo installation
• Review access logs to determine if the vulnerability has been exploited

Patch Information

As of the published advisory, WWBN AVideo versions 26.0 and prior are affected. Organizations should monitor the GitHub Security Advisory for patch release information and update to the latest patched version as soon as it becomes available.

Workarounds

• Block access to the publishInstagram.json.php endpoint using web server configuration or WAF rules
• If the SocialMediaPublisher plugin is not required, disable it entirely through the AVideo administration interface
• Implement network-level access controls to restrict which IP addresses can reach the vulnerable endpoint
• Place the AVideo installation behind a reverse proxy that enforces authentication before allowing access to plugin endpoints

# Apache configuration example to block access to vulnerable endpoint
<Location "/plugin/SocialMediaPublisher/publishInstagram.json.php">
    Order Deny,Allow
    Deny from all
    # Allow only trusted admin IPs if needed
    # Allow from 10.0.0.0/8
</Location>