CVE-2026-59256: WWBN AVideo Auth Bypass Vulnerability

CVE-2026-59256 Overview

CVE-2026-59256 is an authorization bypass vulnerability in WWBN AVideo through commit 9c39d8c8. The getToken() function generates tokens without binding them to a user identity or an intended purpose. The plugin/Gallery/view/sections.php endpoint then issues valid tokens to unauthenticated visitors. An attacker can retrieve a token from the Gallery endpoint and replay it against other subsystems, including view/hls.php, to bypass authorization checks and access restricted video content. The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can obtain authorization tokens from a public Gallery endpoint and reuse them to access restricted video content served by the AVideo platform.

Affected Products

WWBN AVideo through commit 9c39d8c8
plugin/Gallery/view/sections.php endpoint
view/hls.php video streaming subsystem

Discovery Timeline

2026-08-22 - CVE-2026-59256 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-59256

Vulnerability Analysis

AVideo relies on a token returned by getToken() to authorize access to protected resources. The tokens are not scoped to a specific user, session, or endpoint. Any component that trusts the token treats the caller as authorized. Because the Gallery plugin issues these tokens to anonymous visitors, the token effectively acts as a shared secret exposed on a public surface. An attacker requesting the Gallery view receives a valid token in the response and can present the same token to other subsystems that expect an authorized caller.

The practical result is unauthorized read access to media assets that would otherwise require authentication. Restricted HLS video streams served through view/hls.php become reachable by any network-adjacent attacker with knowledge of the target URL.

Root Cause

The root cause is missing binding between generated tokens and both user identity and purpose. getToken() produces credentials without embedding the requesting principal, expiration, or a scope limiting the endpoints where the token is valid. Combined with the Gallery plugin's decision to emit tokens for unauthenticated requests, the design permits token replay across subsystems.

Attack Vector

Exploitation requires only network access to the vulnerable AVideo instance. An attacker sends an unauthenticated request to plugin/Gallery/view/sections.php, extracts the token from the response, and appends it to requests targeting view/hls.php or other token-gated endpoints. No user interaction, credentials, or elevated privileges are required. Refer to the WWBN AVideo GitHub Security Advisory (GHSA-wq57-wxcr-rx6v) and the VulnCheck advisory on the AVideo unbound token bypass for full technical detail.

Detection Methods for CVE-2026-59256

Indicators of Compromise

Unauthenticated HTTP requests to plugin/Gallery/view/sections.php followed by requests to view/hls.php from the same source address within a short time window.
Access log entries showing token parameters reused across multiple endpoint paths from clients that never authenticated.
Spikes in HLS segment retrieval from IP addresses with no prior session establishment.

Detection Strategies

Correlate web server access logs to identify sessions that request Gallery endpoints and subsequently retrieve view/hls.php resources without an authenticated session cookie.
Deploy web application firewall (WAF) rules that flag reuse of a token value across distinct endpoint paths originating from unauthenticated clients.
Baseline legitimate token issuance behavior and alert on anonymous callers receiving tokens at abnormal rates.

Monitoring Recommendations

Enable verbose logging on the AVideo application server, including full request URIs and token parameters, subject to privacy controls.
Forward web and application logs to a centralized analytics platform for cross-endpoint correlation.
Monitor egress bandwidth on the streaming host for unexpected surges consistent with bulk video retrieval.

How to Mitigate CVE-2026-59256

Immediate Actions Required

Upgrade WWBN AVideo to a version released after commit 9c39d8c8 that addresses the unbound token issue.
Restrict access to plugin/Gallery/view/sections.php at the reverse proxy or WAF layer until a patched build is deployed.
Rotate any long-lived tokens or shared secrets that may have been exposed through the Gallery endpoint.

Patch Information

Refer to the WWBN AVideo GitHub Security Advisory GHSA-wq57-wxcr-rx6v for the vendor's fix guidance and remediation commits. Track upstream commits after 9c39d8c8 for the code changes that bind tokens to user identity and purpose.

Workarounds

Place the AVideo Gallery plugin behind authentication by requiring a valid session before requests reach plugin/Gallery/view/sections.php.
Configure the reverse proxy to strip or reject requests carrying tokens obtained from the Gallery endpoint when destined for view/hls.php.
Disable the Gallery plugin entirely if it is not required for production operations.

bash

# Example nginx snippet to require authentication for the Gallery endpoint
location ~ ^/plugin/Gallery/view/sections\.php$ {
    auth_request /internal/session-check;
    proxy_pass http://avideo_backend;
}