CVE-2026-90539: WWBN AVideo Information Disclosure Flaw

CVE-2026-90539 Overview

CVE-2026-90539 is a missing authentication vulnerability in WWBN AVideo, an open-source video streaming platform. The flaw resides in the plugin/TopMenu/menuItems.json.php endpoint and affects builds through commit c3edcc274c389816d434acadac07ee78eaf330c1. Unauthenticated attackers can submit a POST request containing a menuId parameter to retrieve inactive admin menu items. The response exposes hidden URLs that include embedded admin-tool secret query parameters absent from the public navbar. This information disclosure weakness maps to [CWE-200] and gives attackers reconnaissance data useful for follow-on attacks against administrative interfaces.

Critical Impact

Unauthenticated attackers can enumerate hidden administrative menu URLs and extract embedded secret query parameters used by admin tooling.

Affected Products

• WWBN AVideo streaming platform
• Builds through commit c3edcc274c389816d434acadac07ee78eaf330c1
• Deployments exposing the plugin/TopMenu/menuItems.json.php endpoint

Discovery Timeline

• 2026-09-12 - CVE-2026-90539 published to NVD
• 2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90539

Vulnerability Analysis

The vulnerability exists in the AVideo TopMenu plugin, which serves navigation menu data through the menuItems.json.php endpoint. The endpoint accepts POST requests containing a menuId parameter and returns matching menu records. The handler does not verify the requester's session or authorization state before returning results. As a consequence, the endpoint serves records that should be restricted to authenticated administrators, including menu items marked inactive and reserved for administrative tooling. Attackers exploit this behavior remotely, without credentials or user interaction, to harvest sensitive URLs and query strings.

Root Cause

The root cause is a missing authentication check in the request handler for plugin/TopMenu/menuItems.json.php. The code path returns menu metadata based solely on the submitted menuId value. It does not enforce role or session validation, and it does not filter records by the caller's privilege level. Inactive administrative entries are therefore treated identically to public navbar items in the response payload.

Attack Vector

Exploitation requires only network access to the AVideo application. An attacker issues a POST request to the menuItems.json.php endpoint with a menuId value and parses the JSON response. Hidden admin URLs disclosed in the response can contain secret tokens passed as query parameters. Attackers can then replay those URLs to reach admin-tool functionality that relies on the secret query parameters for access, expanding the attack surface beyond the initial disclosure. Refer to the GitHub Security Advisory GHSA-h964-rxm2-fpgj and the VulnCheck Advisory on AVideo for additional technical context.

Detection Methods for CVE-2026-90539

Indicators of Compromise

• Unauthenticated POST requests to /plugin/TopMenu/menuItems.json.php containing a menuId parameter
• HTTP access logs showing repeated menuId value enumeration from a single source IP
• Subsequent requests to admin-tool URLs that include long, non-user-facing query string tokens

Detection Strategies

• Alert on any request to menuItems.json.php that lacks a valid authenticated session cookie or header
• Correlate menuItems.json.php access with follow-up requests to administrative endpoints from the same IP within a short window
• Baseline normal menuId request patterns and flag sequential or brute-force style enumeration

Monitoring Recommendations

• Forward AVideo web server access logs to a centralized log platform for retention and search
• Monitor egress of JSON responses from menuItems.json.php for unusual response sizes indicating multiple records returned
• Track admin-tool URL parameters for reuse from IP addresses that previously queried the TopMenu endpoint

How to Mitigate CVE-2026-90539

Immediate Actions Required

• Restrict access to plugin/TopMenu/menuItems.json.php at the web server or WAF layer until an upstream fix is deployed
• Rotate any admin-tool secret tokens that were embedded in menu item URLs, since they may already be disclosed
• Audit administrative menu entries and remove or relocate secrets that appear in menu URLs

Patch Information

At time of publication, the NVD entry references the GitHub Security Advisory GHSA-h964-rxm2-fpgj and the VulnCheck Advisory on AVideo. Administrators should track those advisories for the fixed commit and upgrade AVideo to the first build that includes the authentication check on menuItems.json.php.

Workarounds

• Block or authenticate requests to plugin/TopMenu/menuItems.json.php using a reverse proxy or WAF rule
• Remove sensitive query parameters from any menu items rendered by the TopMenu plugin and pass secrets through server-side session state instead
• Place the AVideo administrative interface behind network-level controls such as VPN or IP allowlisting

# Example NGINX rule to restrict the vulnerable endpoint to trusted IPs
location = /plugin/TopMenu/menuItems.json.php {
    allow 10.0.0.0/8;
    deny all;
}