CVE-2026-90541: WWBN AVideo Information Disclosure Flaw

CVE-2026-90541 Overview

CVE-2026-90541 is an information disclosure vulnerability in WWBN AVideo, an open-source video streaming platform. The flaw exists in the plugin/TopMenu/menus.json.php endpoint, which fails to enforce authentication before returning menu data. Unauthenticated attackers can send a simple GET request to the endpoint and retrieve all menu entries, including inactive and admin-only items that are hidden from the public navigation bar. The issue is present in AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 and is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Remote, unauthenticated attackers can enumerate hidden administrative menu structures, revealing sensitive routes and admin functionality that aid reconnaissance for follow-on attacks.

Affected Products

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
AVideo TopMenu plugin (plugin/TopMenu/menus.json.php endpoint)
All deployments running the affected commit with the TopMenu plugin enabled

Discovery Timeline

2026-09-12 - CVE-2026-90541 published to NVD
2026-09-19 - Last updated in NVD database

Technical Details for CVE-2026-90541

Vulnerability Analysis

The vulnerability resides in the plugin/TopMenu/menus.json.php endpoint of the WWBN AVideo platform. The endpoint returns the full set of configured navigation menus in JSON format. It performs no session validation, role check, or authentication gate before returning data. As a result, any remote client can query the endpoint and receive the complete menu configuration.

The returned dataset includes menu entries that the application logic would normally suppress in the rendered navbar. This includes menus flagged as inactive and menus scoped to administrator roles. While the exposed data does not directly grant code execution or credential compromise, it provides adversaries with structural knowledge of the application, including hidden administrative routes.

The attack requires no authentication, no user interaction, and no privileges. The impact is limited to confidentiality; integrity and availability are unaffected.

Root Cause

The root cause is a missing authorization check on a JSON data endpoint. The menus.json.php script directly serializes menu records from the backing data store and returns them to the caller. It does not distinguish between authenticated administrators and anonymous visitors, and it does not filter records based on the caller's role or the active flag of each menu.

Attack Vector

An attacker issues an unauthenticated HTTP GET request to /plugin/TopMenu/menus.json.php on a vulnerable AVideo instance. The server responds with a JSON payload containing every configured menu, including entries intended only for administrative users. Attackers can automate this request across internet-exposed AVideo hosts to enumerate hidden admin functionality at scale.

No exploit code is required beyond a standard HTTP client such as curl or a browser. See the VulnCheck advisory and the GitHub Security Advisory GHSA-9xrr-c5w3-f5p7 for the technical write-up.

Detection Methods for CVE-2026-90541

Indicators of Compromise

Unauthenticated HTTP GET requests to /plugin/TopMenu/menus.json.php in web server access logs
Requests to the endpoint originating from unfamiliar IP addresses, cloud provider ranges, or known scanning infrastructure
HTTP 200 responses returning JSON menu data to sessions with no valid authentication cookie

Detection Strategies

Create a web application firewall (WAF) or reverse proxy rule that logs and alerts on all requests to /plugin/TopMenu/menus.json.php without a valid session cookie
Correlate anonymous requests to menus.json.php with subsequent probing of admin routes discovered in the JSON response
Baseline normal request volume to the TopMenu plugin and alert on volumetric anomalies indicative of enumeration

Monitoring Recommendations

Forward AVideo web server access logs to a centralized logging or SIEM platform for retention and search
Monitor for scripted user agents (curl, python-requests, Go-http-client) accessing the vulnerable endpoint
Track outbound reconnaissance patterns from the same source IPs across other AVideo plugin endpoints

How to Mitigate CVE-2026-90541

Immediate Actions Required

Update WWBN AVideo to a commit later than c3edcc274c389816d434acadac07ee78eaf330c1 that includes the authentication fix for menus.json.php
Restrict access to /plugin/TopMenu/menus.json.php at the web server or WAF layer until the patch is applied
Audit web server access logs for prior unauthenticated requests to the endpoint to assess exposure

Patch Information

Refer to the GitHub Security Advisory GHSA-9xrr-c5w3-f5p7 for upstream fix details. Administrators should pull the latest AVideo repository state and redeploy. Verify that the patched menus.json.php enforces an authentication and authorization check before returning menu records, and that inactive or admin-scoped entries are filtered based on the caller's role.

Workarounds

Block or require authentication for /plugin/TopMenu/menus.json.php using an Nginx or Apache location rule
Disable the TopMenu plugin if it is not required for the deployment
Place the AVideo administrative interface behind a VPN or IP allowlist to reduce internet-facing exposure

bash

# Nginx configuration example: deny anonymous access to the vulnerable endpoint
location = /plugin/TopMenu/menus.json.php {
    # Require an authenticated session cookie or return 403
    if ($cookie_PHPSESSID = "") {
        return 403;
    }
    # Optional: restrict by trusted source IPs
    allow 10.0.0.0/8;
    deny all;
}