CVE-2026-86190: WWBN AVideo Information Disclosure Flaw

CVE-2026-86190 Overview

CVE-2026-86190 is a broken access control vulnerability in WWBN AVideo's videoViewsInfo endpoints. The endpoints return complete user records to unauthenticated callers when a hash parameter is supplied. Exposed data includes password hashes, recovery tokens, and live session identifiers for every viewer of the affected videos.

Attackers can replay disclosed session identifiers to hijack viewer sessions, including administrator accounts. They can also harvest personally identifiable information for all users who have watched a video. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated attackers can retrieve password hashes, recovery tokens, and active session identifiers, enabling account takeover of administrator accounts on affected AVideo instances.

Affected Products

WWBN AVideo (open-source video streaming platform)
videoViewsInfo API endpoints accepting a hash parameter
Refer to the GitHub Security Advisory GHSA-82q2-88mq-p44q for exact affected versions

Discovery Timeline

2026-09-05 - CVE-2026-86190 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86190

Vulnerability Analysis

WWBN AVideo exposes videoViewsInfo endpoints intended to return metadata about video viewers. The endpoints accept a hash parameter that is meant to authorize the caller. In vulnerable builds, supplying any value for hash returns complete user records for every viewer, including credentials material and session tokens.

An unauthenticated attacker who queries the endpoint receives password hashes, password recovery tokens, and live session identifiers. Because session identifiers grant authenticated access to the application, the attacker can immediately impersonate any active viewer, including administrators. Recovery tokens further enable persistent takeover through the password reset workflow.

Root Cause

The root cause is missing authorization enforcement on data returned by the videoViewsInfo endpoints. The application relies on knowledge of a hash parameter as an access gate, but does not restrict the response payload to non-sensitive fields. Full database records for user accounts are serialized directly into the response.

Attack Vector

The attack is remote, network-based, and requires no authentication or user interaction. An attacker issues an HTTP request to the vulnerable videoViewsInfo endpoint with a hash parameter and parses the JSON response for session_id, password hash, and token fields. The attacker then sets the stolen session cookie in a browser or HTTP client to gain the victim's privileges.

No verified proof-of-concept code is published. See the VulnCheck Advisory for technical details on the request and response behavior.

Detection Methods for CVE-2026-86190

Indicators of Compromise

Unauthenticated HTTP requests to videoViewsInfo endpoints containing a hash query parameter from unfamiliar source IPs.
Response payloads from videoViewsInfo containing fields such as password, recoverPass, or session_id.
Concurrent administrator sessions originating from geographically implausible source addresses.
Sudden bursts of password reset activity or unexpected account modifications following endpoint access.

Detection Strategies

Inspect web server and application logs for requests to URLs matching videoViewsInfo with anomalous frequency or high response sizes.
Alert on any AVideo response body that includes credential hash patterns leaving the server perimeter.
Correlate session identifier reuse across distinct IP addresses or user agents within short time windows.

Monitoring Recommendations

Enable verbose access logging on AVideo web front ends and forward logs to a centralized analytics platform.
Monitor administrator login events for source-address anomalies and out-of-hours activity.
Track password reset token issuance and consumption rates for statistical outliers.

How to Mitigate CVE-2026-86190

Immediate Actions Required

Upgrade WWBN AVideo to the fixed version identified in GHSA-82q2-88mq-p44q.
Invalidate all active user sessions and force re-authentication after patching.
Reset password recovery tokens and require password rotation for administrator accounts.
Review web server access logs for prior exploitation attempts targeting videoViewsInfo.

Patch Information

Apply the vendor-supplied update referenced in the WWBN AVideo Security Advisory GHSA-82q2-88mq-p44q. The advisory documents the fixed release and the specific commits that restrict the videoViewsInfo response to authorized fields.

Workarounds

Block or restrict access to videoViewsInfo endpoints at the reverse proxy or web application firewall until the patch is applied.
Enforce an allowlist of source IPs for administrative and API paths on public AVideo deployments.
Disable video view analytics features that depend on the vulnerable endpoint if not required.

bash

# Example NGINX rule to block unauthenticated access to the vulnerable endpoint
location ~* /videoViewsInfo {
    deny all;
    return 403;
}