CVE-2026-90542: WWBN AVideo Auth Bypass Vulnerability

CVE-2026-90542 Overview

CVE-2026-90542 is a missing authorization vulnerability in WWBN AVideo, an open-source video streaming platform. The flaw resides in remindMe.json.php, which fails to verify whether the requesting user has permission to view a target live schedule before creating a reminder. Authenticated attackers can create scheduler reminders for private live schedules they cannot view. The generated email job then leaks the private schedule title back to the attacker. The issue affects WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 and is tracked under [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact
Authenticated users can enumerate and disclose titles of private live schedules that should not be visible to them, breaking confidentiality boundaries on scheduled live streams.

Affected Products

WWBN AVideo streaming platform
Builds through commit c3edcc274c389816d434acadac07ee78eaf330c1
Deployments exposing remindMe.json.php to authenticated users

Discovery Timeline

2026-09-12 - CVE-2026-90542 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90542

Vulnerability Analysis

WWBN AVideo exposes remindMe.json.php to let authenticated users subscribe to reminders for upcoming live schedules. The endpoint accepts a schedule identifier from the client and creates a reminder record along with an outbound email job. The endpoint does not verify that the current user has read access to the referenced schedule before performing this work. As a result, any authenticated user can pass an identifier for a private schedule they cannot view and receive a successful response.

The generated email job embeds the private schedule title. That title is returned or observable through the reminder workflow, disclosing metadata that the access control layer was supposed to protect. The vulnerability is a broken object-level authorization issue: authorization is inferred from being logged in, rather than from ownership or visibility of the target object.

Root Cause

The root cause is missing authorization enforcement on a user-controlled object reference. remindMe.json.php trusts the supplied schedule identifier without cross-checking it against the caller's permission to view that schedule. This matches the pattern described by [CWE-639], where access is granted based on possession of a key rather than validated privilege.

Attack Vector

Exploitation requires network access to the AVideo instance and a low-privileged authenticated account. The attacker sends a crafted request to remindMe.json.php referencing a private schedule identifier. The server creates a reminder and produces an email job whose contents disclose the private schedule title. No user interaction from a victim is required.

Refer to the GitHub Security Advisory GHSA-qf26-4xp7-q5h9 and the VulnCheck advisory on the missing authorization in remindMe.json.php for additional context.

Detection Methods for CVE-2026-90542

Indicators of Compromise

Requests to remindMe.json.php from a single authenticated session referencing many sequential or unrelated schedule identifiers.
Reminder records tied to schedules the requesting user does not own or cannot otherwise view in the UI.
Outbound email jobs referencing schedule titles that were never listed on the requester's account.

Detection Strategies

Review web server and application logs for POST or GET traffic to remindMe.json.php and correlate the referenced schedule owner against the authenticated user identifier.
Alert when the ratio of reminder creations to schedules visible to a user exceeds a reasonable threshold, indicating enumeration.
Inspect the reminders and email queue tables for entries linking users to private schedules they are not authorized to view.

Monitoring Recommendations

Enable verbose access logging on the AVideo application tier and forward logs to a centralized analytics platform.
Retain email job queue history long enough to reconstruct which schedule titles were exposed to which users.
Establish a baseline of normal remindMe.json.php request volume per account and alert on deviations.

How to Mitigate CVE-2026-90542

Immediate Actions Required

Upgrade WWBN AVideo to a build later than commit c3edcc274c389816d434acadac07ee78eaf330c1 once a patched release is available.
Audit existing reminder records and remove any that reference private schedules the associated users cannot view.
Restrict access to the AVideo application to trusted authenticated user populations until a patch is applied.

Patch Information

At the time of publication, remediation guidance is tracked in the WWBN AVideo GitHub Security Advisory GHSA-qf26-4xp7-q5h9. Apply the fix from the upstream repository and redeploy the affected instances. The correct fix enforces an authorization check inside remindMe.json.php that validates the caller's ability to view the target schedule before creating a reminder or queuing an email job.

Workarounds

Place remindMe.json.php behind a web application firewall rule that requires the referenced schedule identifier to belong to the authenticated user's owned or subscribed set.
Temporarily disable the live schedule reminder feature by returning an error from remindMe.json.php at the reverse proxy until the patched build is deployed.
Reduce the sensitivity of private schedule titles where feasible, so that any inadvertent disclosure carries lower business impact.

bash

# Example nginx block to disable the vulnerable endpoint until patched
location = /plugin/Live/remindMe.json.php {
    return 503;
}