CVE-2026-90540: WWBN AVideo Auth Bypass Vulnerability

CVE-2026-90540 Overview

CVE-2026-90540 is a missing authorization vulnerability [CWE-862] in WWBN AVideo, an open-source video streaming platform. The flaw exists in the playListAddVideo.json.php endpoint through commit c3edcc274c389816d434acadac07ee78eaf330c1. The endpoint fails to validate watch permissions when users add videos to playlists. Authenticated attackers can add password-protected videos they lack permission to view into their own playlists by submitting the video ID and playlist ID parameters.

Critical Impact
Authenticated users can bypass content access controls and add restricted, password-protected videos to playlists they own, breaking the confidentiality boundary intended by content owners.

Affected Products

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
AVideo playListAddVideo.json.php endpoint
Deployments with password-protected video content

Discovery Timeline

2026-09-12 - CVE-2026-90540 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90540

Vulnerability Analysis

The vulnerability is a missing authorization check [CWE-862] in AVideo's playlist management workflow. The playListAddVideo.json.php endpoint accepts a video ID and a playlist ID from an authenticated user. It writes the association into the database without verifying whether the requesting user has permission to watch the target video.

AVideo supports password-protected videos where the intended access control model requires the viewer to supply a password before viewing content. The playlist add operation ignores that constraint. Authenticated attackers can therefore reference video IDs they cannot legitimately watch and persist them into playlists under their control.

The issue is a business logic and access control flaw rather than a memory safety or injection issue. It affects the confidentiality boundary of the video sharing feature and undermines the assumption that password-gated content remains restricted to authorized viewers.

Root Cause

The root cause is the absence of a watch-permission check inside playListAddVideo.json.php prior to inserting the video-playlist association. The endpoint enforces authentication and playlist ownership but does not evaluate whether the calling user meets the access requirements of the referenced video, such as password validation for protected content.

Attack Vector

Exploitation requires network access to the AVideo instance and a valid authenticated session with low privileges. An attacker enumerates or guesses valid video IDs, submits them to playListAddVideo.json.php along with a playlist ID they own, and the server accepts the request. The vulnerability does not enable arbitrary code execution or direct disclosure of video contents; it violates the intended authorization model for playlist composition and content association. For full technical detail, see the GitHub Security Advisory GHSA-xhg9-rc5h-rp65 and the VulnCheck Advisory on AVideo.

Detection Methods for CVE-2026-90540

Indicators of Compromise

Requests to playListAddVideo.json.php from authenticated users referencing video IDs that belong to password-protected content the user has never successfully unlocked.
Playlists containing entries for videos the owning user has no prior watch history or password submission for.
Anomalous volumes of playlist add operations from a single account, suggesting enumeration of video IDs.

Detection Strategies

Correlate application logs from playListAddVideo.json.php with the video access control table to flag additions of restricted videos by users lacking password validation.
Alert on sequential or scripted access patterns against the playlist add endpoint that iterate through video ID ranges.
Review database records for playlist_video associations that reference protected video IDs added by non-owner accounts.

Monitoring Recommendations

Enable verbose HTTP request logging on AVideo endpoints under plugin/PlayLists/ and preserve logs for retrospective review.
Monitor authentication events and correlate session identifiers with playlist modification activity.
Track outbound sharing of playlists that contain protected videos to detect downstream disclosure attempts.

How to Mitigate CVE-2026-90540

Immediate Actions Required

Inventory AVideo deployments and identify installations running at or before commit c3edcc274c389816d434acadac07ee78eaf330c1.
Apply the vendor patch referenced in the GitHub Security Advisory GHSA-xhg9-rc5h-rp65 once available.
Audit existing playlists for entries referencing password-protected videos added by non-authorized users and remove them.

Patch Information

Refer to the upstream WWBN AVideo repository and the GitHub Security Advisory GHSA-xhg9-rc5h-rp65 for the fixed commit and upgrade guidance. The fix must introduce a watch-permission check in playListAddVideo.json.php that validates the requester against the target video's access controls before the association is persisted.

Workarounds

Restrict access to the AVideo instance to trusted authenticated users while a patch is deployed.
Disable the playlist feature at the plugin level if password-protected content confidentiality is a strict requirement.
Place a web application firewall rule in front of playListAddVideo.json.php to enforce additional authorization checks or rate limiting.

bash

# Example WAF rule concept: rate-limit and log playlist add requests
# Adjust to match your WAF syntax; this is illustrative only.
location /plugin/PlayLists/playListAddVideo.json.php {
    limit_req zone=playlist_add burst=5 nodelay;
    access_log /var/log/nginx/playlist_add.log;
}