CVE-2026-90536: WWBN AVideo Information Disclosure Vulnerability

CVE-2026-90536 Overview

CVE-2026-90536 is a missing authorization vulnerability in WWBN AVideo, an open-source video streaming platform. The flaw affects the adsInfo API endpoint through commit c3edcc274c389816d434acadac07ee78eaf330c1. Unauthenticated attackers can query the endpoint with a videos_id parameter to retrieve the owner's user ID and personalized ad creative URLs for password-protected videos. The vulnerability maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. No authentication, permission checks, or user interaction are required to exploit the endpoint over the network.

Critical Impact
Unauthenticated attackers can enumerate owner identifiers for password-protected videos and harvest personalized ad creative URLs through a single API request.

Affected Products

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
AVideo instances exposing the adsInfo API endpoint
Deployments relying on password-protected videos for privacy

Discovery Timeline

2026-09-12 - CVE-2026-90536 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90536

Vulnerability Analysis

The vulnerability resides in the adsInfo API endpoint of WWBN AVideo. The endpoint accepts a videos_id parameter and returns metadata associated with the requested video, including the owner's user ID and personalized ad creative URLs. The endpoint does not verify whether the caller is authenticated or whether the caller has permission to access the referenced video. As a result, attackers can request information about videos that are marked as password-protected without ever supplying the password. This exposes internal user identifiers and ad delivery URLs that were expected to remain private to authorized viewers.

Root Cause

The endpoint is missing authorization logic. It processes the videos_id parameter and returns data without checking session state, API tokens, or per-video access controls tied to the password-protection mechanism. The design assumes ad metadata is non-sensitive, but the response body includes user identifiers that support enumeration and correlation attacks against the platform.

Attack Vector

Exploitation is remote and network-based over HTTP. An attacker iterates videos_id values against the adsInfo endpoint and parses the JSON response for owner IDs and personalized ad URLs. Because no authentication is required, the attack can be automated against any reachable AVideo instance and does not generate authenticated audit trails. See the GitHub Security Advisory GHSA-989c-frwf-gprj and the VulnCheck Advisory on AVideo for full technical context. No verified proof-of-concept code is published at this time.

Detection Methods for CVE-2026-90536

Indicators of Compromise

Unauthenticated HTTP requests to URLs containing adsInfo with a videos_id query parameter.
Sequential or high-volume enumeration of videos_id values from a single source IP address.
Web server access logs showing responses to adsInfo requests without an associated authenticated session cookie.

Detection Strategies

Parse web server logs for requests to the adsInfo endpoint and flag those lacking authenticated session identifiers.
Correlate adsInfo request volume against baseline traffic to identify enumeration patterns.
Alert on responses to adsInfo requests whose referenced videos_id corresponds to a password-protected video.

Monitoring Recommendations

Enable verbose access logging on the AVideo web front end, including query strings and source IP addresses.
Forward web and application logs into a centralized analytics platform for rate-based anomaly identification.
Track distinct videos_id counts per client per hour to surface scraping behavior against the API.

How to Mitigate CVE-2026-90536

Immediate Actions Required

Inventory all WWBN AVideo deployments and identify instances running commit c3edcc274c389816d434acadac07ee78eaf330c1 or earlier.
Restrict access to the adsInfo endpoint at the reverse proxy or web application firewall until an upstream fix is deployed.
Review web server logs for prior enumeration activity against adsInfo and notify affected video owners if disclosure occurred.

Patch Information

At publication time, no fixed release identifier is listed in the NVD entry for CVE-2026-90536. Administrators should monitor the GitHub Security Advisory GHSA-989c-frwf-gprj and upstream AVideo repository commits for the corrective patch and apply it once released.

Workarounds

Block or rewrite external requests to the adsInfo endpoint using a WAF rule or reverse proxy filter.
Require an authenticated session cookie at the proxy layer before requests reach the AVideo application for ad-related endpoints.
Rate-limit requests to adsInfo per source IP to slow enumeration attempts.

bash

# Example NGINX rule to require authentication cookie for adsInfo
location ~* /plugin/.*adsInfo {
    if ($cookie_PHPSESSID = "") {
        return 403;
    }
    limit_req zone=api_limit burst=5 nodelay;
    proxy_pass http://avideo_backend;
}