CVE-2026-58002: WWBN AVideo Authorization Bypass Vulnerability

CVE-2026-58002 Overview

CVE-2026-58002 is an authorization bypass vulnerability in WWBN AVideo, an open-source video streaming platform. The flaw exists in the Users_affiliations/add.json.php endpoint through commit 9c39d8c8b4c1f75540788d6b391740852ceb0732. Authenticated users can forge two-party consent records by supplying the counterparty's agreement timestamp. The forged affiliation record receives status='a' (accepted) without the counterparty's approval. Attackers then leverage the videoAddNew.json.php endpoint, which trusts the forged affiliation as an authorization term, to reassign video ownership to arbitrary users. The vulnerability is categorized under [CWE-345] (Insufficient Verification of Data Authenticity).

Critical Impact
Authenticated attackers can forge affiliation consent records and hijack ownership of arbitrary videos on the platform.

Affected Products

WWBN AVideo through commit 9c39d8c8b4c1f75540788d6b391740852ceb0732
Users_affiliations/add.json.php endpoint
videoAddNew.json.php endpoint

Discovery Timeline

2026-08-22 - CVE-2026-58002 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-58002

Vulnerability Analysis

The vulnerability originates in the affiliation workflow of WWBN AVideo. Affiliations are two-party relationships between users that require mutual consent before being considered valid. The Users_affiliations/add.json.php endpoint accepts input parameters that include the counterparty's agreement timestamp. The endpoint fails to verify that the counterparty actually authorized the relationship.

An authenticated user can submit a request that populates both sides of the consent record. The resulting affiliation is stored with status='a', indicating the relationship is accepted. Downstream code paths, including videoAddNew.json.php, use the presence of an accepted affiliation as an authorization decision when reassigning video ownership. Because the affiliation itself is forged, the ownership transfer proceeds without the target user's involvement.

Root Cause

The root cause is missing server-side verification of the counterparty's identity and consent. The application trusts client-supplied timestamps and status fields instead of requiring an independent acceptance action from the second user. This aligns with [CWE-345], where data authenticity is not properly validated before use in security-sensitive decisions.

Attack Vector

Exploitation requires network access to the AVideo instance and a low-privilege authenticated account. The attacker sends a crafted POST request to Users_affiliations/add.json.php that includes the target user's identifier and a fabricated acceptance timestamp. After the forged affiliation is created, the attacker calls videoAddNew.json.php to transfer ownership of one or more videos to a chosen account. No user interaction from the victim is required.

For payload structure and reproduction details, see the VulnCheck Authorization Bypass Advisory and the GitHub Security Advisory.

Detection Methods for CVE-2026-58002

Indicators of Compromise

POST requests to /plugin/Users_affiliations/add.json.php containing counterparty acceptance timestamps issued by a single user session.
Affiliation records in the database with status='a' created without a corresponding acceptance request from the second party.
Unexpected ownership changes in the videos table originating from calls to videoAddNew.json.php.
Video ownership transfers to accounts that have no prior affiliation history with the original owner.

Detection Strategies

Correlate Users_affiliations insertion events with the authenticated session identifier and confirm that two distinct user sessions participated in the workflow.
Alert on videoAddNew.json.php requests that modify the users_id field of existing videos.
Review web server access logs for sequential requests to add.json.php followed by videoAddNew.json.php from the same source IP within a short time window.

Monitoring Recommendations

Enable database audit logging on the affiliations and videos tables to capture INSERT and UPDATE operations with actor context.
Monitor authenticated API traffic for anomalous parameter combinations, particularly requests containing both parties' timestamps.
Baseline the normal rate of video ownership transfers and alert on deviations.

How to Mitigate CVE-2026-58002

Immediate Actions Required

Update WWBN AVideo to a commit that post-dates 9c39d8c8b4c1f75540788d6b391740852ceb0732 and includes the affiliation authorization fix.
Audit existing affiliation records for entries with status='a' that lack a documented two-party workflow.
Review recent video ownership changes and revert unauthorized transfers.
Rotate credentials for any accounts suspected of abusing the endpoint.

Patch Information

Refer to the GitHub Security Advisory GHSA-rg7g-cgjq-4wx8 for the fixed commit and upgrade guidance. Apply the vendor patch that enforces server-side verification of counterparty consent before accepting affiliation records.

Workarounds

Restrict access to /plugin/Users_affiliations/add.json.php at the web server or reverse proxy layer until the patch is applied.
Disable the affiliations plugin if it is not required for platform operation.
Require administrator approval for any video ownership reassignment performed through videoAddNew.json.php.

bash

# Example nginx configuration to block the vulnerable endpoint
location ~* /plugin/Users_affiliations/add\.json\.php$ {
    deny all;
    return 403;
}