CVE-2026-90538: AVideo Information Disclosure Vulnerability

CVE-2026-90538 Overview

CVE-2026-90538 is a missing authorization vulnerability in WWBN AVideo, an open-source video streaming platform. The flaw resides in playlistsFromUser.json.php and allows unauthenticated attackers to read private playlists belonging to other users. Attackers retrieve Favorite and Watch Later playlists by submitting another user's identifier in a request. The root cause is improper cache keying that conflates responses across different user contexts. The issue affects WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 and is classified under [CWE-200] Information Exposure.

Critical Impact
Unauthenticated remote attackers can enumerate and disclose private user playlist data over the network without any user interaction.

Affected Products

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Deployments exposing playlistsFromUser.json.php on public interfaces
Instances relying on the shared cache layer for playlist responses

Discovery Timeline

2026-09-12 - CVE-2026-90538 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90538

Vulnerability Analysis

The vulnerability affects the playlistsFromUser.json.php endpoint in WWBN AVideo. The endpoint returns playlist metadata for a user identifier supplied in the request. It does not verify that the caller is authorized to view non-public playlists for that identifier. As a result, an unauthenticated remote attacker can request the endpoint with an arbitrary users_id and receive private Favorite and Watch Later playlists.

The bug is compounded by an application cache that keys responses on the target user identifier rather than on the caller's authentication context. Cached responses generated for one caller are served to unrelated callers, extending disclosure across sessions. The confidentiality impact is limited to playlist data, but that data can reveal viewing history and user preferences.

Root Cause

The endpoint omits an authorization check before serving playlist entries flagged as private. The cache layer aggravates the flaw by treating the target user identifier as a sufficient cache key. Any authenticated context that populated the cache leaks into subsequent unauthenticated requests for the same identifier.

Attack Vector

Exploitation requires network access to the AVideo instance and knowledge or enumeration of a target users_id. The attacker issues an HTTP GET to playlistsFromUser.json.php with the target identifier. No authentication, privileges, or user interaction are required. Refer to the GitHub Security Advisory GHSA-6382 and the VulnCheck Advisory on AVideo Authorization for endpoint specifics.

// No verified exploit code available. See linked advisories for endpoint details.

Detection Methods for CVE-2026-90538

Indicators of Compromise

Unauthenticated HTTP requests to playlistsFromUser.json.php containing varying users_id parameters
Sequential or scripted enumeration of users_id values from a single source IP
Cache hits returning private playlist entries to sessions without a matching authenticated user

Detection Strategies

Alert on access-log entries where playlistsFromUser.json.php is requested without a valid session cookie or bearer token
Correlate responses containing playlist type identifiers for Favorite or Watch Later with unauthenticated request contexts
Baseline the volume of requests to the endpoint per source IP and flag deviations that indicate enumeration

Monitoring Recommendations

Forward web server access logs and application logs to a centralized analytics platform for retention and query
Instrument the cache layer to record cache-key composition and detect responses served across mismatched user contexts
Track outbound response sizes on the endpoint to identify bulk data disclosure patterns

How to Mitigate CVE-2026-90538

Immediate Actions Required

Restrict network exposure of playlistsFromUser.json.php at the web server or reverse proxy layer until a patched build is deployed
Invalidate existing playlist caches to purge entries populated with private data under the vulnerable code path
Audit web access logs for prior requests to the endpoint and identify accounts whose playlist data may have been disclosed

Patch Information

Apply the fix referenced in the GitHub Security Advisory GHSA-6382. Upgrade beyond commit c3edcc274c389816d434acadac07ee78eaf330c1 to a build that enforces authorization on playlistsFromUser.json.php and includes the caller identity in the cache key.

Workarounds

Block or require authentication for requests to playlistsFromUser.json.php via a web application firewall rule
Disable response caching for playlist endpoints until the fixed release is installed
Mark Favorite and Watch Later playlists as non-shareable through administrative configuration where supported

bash

# Example nginx rule to require an authenticated session cookie on the vulnerable endpoint
location = /plugin/PlayLists/playlistsFromUser.json.php {
    if ($cookie_PHPSESSID = "") {
        return 403;
    }
    proxy_pass http://avideo_backend;
}