CVE-2026-90545 Overview
CVE-2026-90545 is a missing authorization vulnerability [CWE-862] in WWBN AVideo, an open-source video streaming platform. The flaw resides in the commentAddNew.json.php endpoint, which fails to validate video access permissions before accepting comment submissions. Authenticated users can post comments on password-protected and group-restricted videos they are not authorized to view. The issue affects WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1.
Critical Impact
Authenticated attackers can bypass password and group-based access controls to interact with restricted video content through the comment endpoint.
Affected Products
- WWBN AVideo streaming platform
- Builds through commit c3edcc274c389816d434acadac07ee78eaf330c1
- Deployments exposing commentAddNew.json.php to authenticated users
Discovery Timeline
- 2026-09-12 - CVE-2026-90545 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-90545
Vulnerability Analysis
The vulnerability exists in the comment submission workflow of WWBN AVideo. The commentAddNew.json.php endpoint accepts POST requests from authenticated users to create new comments on videos. The handler validates that the request originates from a logged-in session but does not verify whether the session holder is authorized to access the target video. As a result, restrictions such as password gating and group membership are enforced only in the playback path, not in the comment API.
An attacker with a valid low-privileged account can send a POST request referencing the identifier of a restricted video. The server accepts the comment and stores it against the video record. This exposes protected content metadata and allows tampering with discussion threads on videos the attacker cannot legitimately watch.
Root Cause
The root cause is a missing authorization check [CWE-862] in the comment creation logic. Access control decisions are enforced at the video playback layer but not replicated in the comment API endpoint. The endpoint trusts the authenticated session without re-validating video-level permissions such as password verification or group membership.
Attack Vector
Exploitation requires network access to the AVideo instance and a valid authenticated session with low privileges. The attacker sends a crafted POST request to commentAddNew.json.php containing the target video identifier and comment payload. No user interaction from the victim is required. Refer to the GitHub Security Advisory and the VulnCheck Advisory on AVideo for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-90545
Indicators of Compromise
- POST requests to commentAddNew.json.php from user sessions that have no prior playback activity on the referenced video.
- Comments appearing on password-protected or group-restricted videos from accounts outside the authorized group.
- Unusual sequences of comment submissions targeting multiple restricted video IDs from a single account.
Detection Strategies
- Correlate web server logs for commentAddNew.json.php requests against video access logs to identify comments posted without a preceding authorized view.
- Alert on authenticated users interacting with video IDs that require passwords or group membership they do not possess.
- Baseline normal comment behavior per account and flag anomalous cross-video comment activity.
Monitoring Recommendations
- Enable verbose HTTP logging for AVideo comment endpoints including session identifiers and target video IDs.
- Forward AVideo application and web server logs to a centralized analytics platform for correlation with authentication events.
- Review audit trails for restricted videos to confirm the comment authors were legitimately granted access.
How to Mitigate CVE-2026-90545
Immediate Actions Required
- Update WWBN AVideo to a build later than commit c3edcc274c389816d434acadac07ee78eaf330c1 once a fixed release is available.
- Audit existing comments on password-protected and group-restricted videos and remove entries from unauthorized accounts.
- Restrict registration and require administrator approval to limit the pool of authenticated attackers.
Patch Information
At the time of publication, refer to the GitHub Security Advisory GHSA-v3p2-4x76-7p8v for the authoritative patch status and remediation guidance from the WWBN AVideo maintainers.
Workarounds
- Block or rate-limit access to commentAddNew.json.php at a reverse proxy or web application firewall for unauthenticated and low-trust sessions.
- Disable comments globally on restricted videos until an upstream fix is applied.
- Apply a temporary server-side check that validates the requesting user's permission on the target video before storing new comments.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
