CVE-2026-90537: WWBN AVideo Auth Bypass Vulnerability

CVE-2026-90537 Overview

CVE-2026-90537 is a missing authorization vulnerability in WWBN AVideo, an open-source video streaming and management platform. The flaw exists in plugin/Scheduler/sendEmail.json.php and is present through commit c3edcc274c389816d434acadac07ee78eaf330c1. The endpoint accepts a site-wide daily token as its only authorization control, which any visitor can obtain from public Live pages. Unauthenticated attackers use this token to enumerate scheduler email jobs, read private live stream titles and recipient email addresses, and trigger email dispatch. The weakness is classified as [CWE-862] Missing Authorization.

Critical Impact

Remote unauthenticated attackers can read private scheduler data and send emails on behalf of the AVideo instance by replaying a token exposed on public Live pages.

Affected Products

• WWBN AVideo streaming platform
• Deployments running through commit c3edcc274c389816d434acadac07ee78eaf330c1
• Installations with the Scheduler plugin enabled

Discovery Timeline

• 2026-09-12 - CVE-2026-90537 published to NVD
• 2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90537

Vulnerability Analysis

The Scheduler plugin exposes sendEmail.json.php as a JSON endpoint used to manage scheduled email jobs tied to live streams. The endpoint enforces access using a daily token rather than a per-user session or capability check. Because the same token is embedded in publicly accessible Live pages, any visitor can harvest it and reuse it against the scheduler endpoint. The endpoint then returns job data and permits attackers to trigger outbound email delivery.

Successful exploitation exposes private stream titles and subscriber email addresses stored by the plugin. Attackers can also use the endpoint to send emails through the platform's mail infrastructure, enabling phishing or reputation-damaging content delivery. According to the VulnCheck advisory, no user interaction or prior authentication is required.

Root Cause

The root cause is reliance on a shared, publicly derivable secret as the sole authorization gate. The scheduler endpoint does not validate the caller's identity, role, or ownership of the requested job. This design pattern violates the principle of least privilege and matches [CWE-862] Missing Authorization.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker retrieves the current daily token from any Live page served by the target instance. The attacker then issues HTTP requests to plugin/Scheduler/sendEmail.json.php with the token as a parameter to enumerate jobs, read job metadata, or invoke email sending.

No verified proof-of-concept code is published. For technical detail, refer to the GitHub Security Advisory GHSA-qq59-3jwp-hgj9.

Detection Methods for CVE-2026-90537

Indicators of Compromise

• Unauthenticated HTTP requests to plugin/Scheduler/sendEmail.json.php originating from external IP addresses.
• Repeated requests using the same daily token value across many source addresses within a short window.
• Unexpected outbound emails from the AVideo mail sender that do not correspond to administrator-initiated jobs.
• Web server access logs showing sequential enumeration of scheduler job IDs.

Detection Strategies

• Alert on any request path containing Scheduler/sendEmail.json.php where the session cookie is absent or not tied to an administrative account.
• Correlate scheduler endpoint hits with outbound SMTP volume spikes on the AVideo host.
• Baseline normal daily request volume to the scheduler endpoint and flag deviations.

Monitoring Recommendations

• Ingest AVideo web server logs into a centralized SIEM and retain them long enough to investigate token reuse patterns.
• Monitor mail server logs for messages sent through the AVideo relay that reference unknown scheduler job IDs.
• Track HTTP 200 responses to sendEmail.json.php from unauthenticated clients as a high-priority signal.

How to Mitigate CVE-2026-90537

Immediate Actions Required

• Update WWBN AVideo to a commit that post-dates c3edcc274c389816d434acadac07ee78eaf330c1 and includes the vendor's fix for GHSA-qq59-3jwp-hgj9.
• Restrict access to plugin/Scheduler/ at the web server or reverse proxy layer so only authenticated administrator IP ranges can reach it.
• Rotate any exposed scheduler jobs, review sent-mail logs, and notify affected recipients if private data was exposed.

Patch Information

Refer to the GitHub Security Advisory GHSA-qq59-3jwp-hgj9 for the fixed commit and upgrade guidance. The advisory is the authoritative source for the remediated version. Confirm the deployed commit hash after upgrade to verify the fix is applied.

Workarounds

• Disable the Scheduler plugin if it is not required by the deployment.
• Add a web server rule that requires HTTP basic authentication or an authenticated session cookie for any request to plugin/Scheduler/sendEmail.json.php.
• Block requests to the scheduler endpoint from source addresses outside of trusted administrative networks.

# Example nginx location block restricting the vulnerable endpoint
location ~ ^/plugin/Scheduler/sendEmail\.json\.php$ {
    allow 10.0.0.0/8;      # trusted admin network
    deny  all;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}