CVE-2026-90544 Overview
CVE-2026-90544 is a missing authorization vulnerability [CWE-862] in WWBN AVideo, an open-source video streaming platform. The flaw exists in the videoAddViewCount.json.php endpoint, which updates video view statistics without validating whether the requesting user has permission to access the target video. Authenticated attackers can submit requests containing arbitrary video IDs to increment view counts and watch-time metrics on videos they cannot otherwise access. The issue affects WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1.
Critical Impact
Authenticated attackers can manipulate view count and watch-time statistics on restricted videos, corrupting analytics data and skewing content ranking or monetization mechanisms that depend on view metrics.
Affected Products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
- videoAddViewCount.json.php endpoint
- Video statistics and analytics subsystem
Discovery Timeline
- 2026-09-12 - CVE-2026-90544 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-90544
Vulnerability Analysis
The vulnerability resides in the videoAddViewCount.json.php endpoint of WWBN AVideo. This endpoint is designed to record a viewer's engagement with a video by updating view count and watch-time statistics. The endpoint accepts a video identifier from the request but does not verify that the authenticated user has permission to view the specified video before writing statistics for it.
Because the endpoint trusts client-supplied video IDs, an authenticated attacker can enumerate or guess identifiers for private, unlisted, paid, or otherwise access-restricted videos and submit view-tracking requests against them. Each request causes the server to increment metrics on content the attacker cannot legitimately access. Downstream systems that consume these metrics, such as trending algorithms, creator dashboards, and monetization pipelines, will treat the fabricated engagement as real.
Root Cause
The root cause is a missing authorization check [CWE-862] between authentication and the state-changing statistics update. The endpoint validates that the caller is authenticated but omits an entitlement check confirming the caller has read access to the video associated with the supplied ID. This is a classic broken access control pattern where authorization is assumed rather than enforced at the resource boundary.
Attack Vector
Exploitation requires network access to the AVideo instance and a valid low-privilege authenticated session. The attacker sends crafted HTTP requests to videoAddViewCount.json.php with arbitrary video IDs corresponding to videos outside their access scope. No user interaction is required from the video owner or other users. Refer to the GitHub Security Advisory GHSA-2fgr-549m-8g5w and the VulnCheck Advisory on AVideo for further technical detail.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-90544
Indicators of Compromise
- Repeated POST or GET requests to videoAddViewCount.json.php from a single authenticated session referencing many distinct video IDs in a short time window.
- View count or watch-time growth on private, unlisted, or unreleased videos that have not been publicly shared.
- Sequential or enumerated video ID patterns in access logs targeting the view count endpoint.
Detection Strategies
- Baseline normal per-user request rates to videoAddViewCount.json.php and alert on sessions that exceed expected ratios of view-count requests to actual video page loads.
- Correlate view-count endpoint hits with prior authorization-checked video playback requests from the same session; unmatched view-count writes indicate abuse.
- Query analytics datasets for videos whose metric growth does not correlate with playback or CDN egress activity.
Monitoring Recommendations
- Ingest AVideo web server access logs into a centralized log store and retain full URI parameters including video IDs.
- Alert on authenticated sessions issuing view-count requests for video IDs never returned in that user's prior catalog or search responses.
- Track integrity of view count and watch-time counters for restricted content and flag anomalies for creator or admin review.
How to Mitigate CVE-2026-90544
Immediate Actions Required
- Inventory all AVideo deployments and identify instances at or before commit c3edcc274c389816d434acadac07ee78eaf330c1.
- Update AVideo to a version that includes the authorization fix referenced in the GitHub Security Advisory GHSA-2fgr-549m-8g5w.
- Review recent view count and watch-time data for restricted videos and reconcile against playback logs before trusting analytics or payout calculations.
Patch Information
A fix is published through the upstream WWBN AVideo project. Administrators should apply the update referenced in the GitHub Security Advisory GHSA-2fgr-549m-8g5w and the VulnCheck Advisory on AVideo. Any deployment at or before commit c3edcc274c389816d434acadac07ee78eaf330c1 should be considered vulnerable until upgraded.
Workarounds
- Restrict access to videoAddViewCount.json.php at the web server or reverse proxy layer for user roles that do not require view tracking.
- Apply rate limiting per authenticated session on the view count endpoint to reduce the impact of enumeration.
- Temporarily disable public trending or monetization features that rely on view metrics until the patch is deployed and historical data is validated.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
