CVE-2026-90546: WWBN AVideo Auth Bypass Vulnerability

CVE-2026-90546 Overview

CVE-2026-90546 is a missing authorization vulnerability [CWE-862] in WWBN AVideo, an open-source video streaming platform. The flaw resides in the like.json.php endpoint, which fails to validate whether an authenticated user has permission to view a video before recording a like. Any logged-in user can submit like requests for password-protected or group-restricted videos they cannot legitimately access. The issue affects WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1.

Critical Impact
Authenticated users can bypass access controls to interact with restricted videos, inflating engagement counters and undermining content protection boundaries on the platform.

Affected Products

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Password-protected video content within affected AVideo installations
Group-restricted video content within affected AVideo installations

Discovery Timeline

2026-09-12 - CVE-2026-90546 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90546

Vulnerability Analysis

The vulnerability is a broken access control issue in the video interaction pipeline of WWBN AVideo. The like.json.php endpoint accepts a video identifier and records a like on behalf of the authenticated user. It does not consult the same authorization layer that gates video playback.

As a result, restrictions applied by password protection or group membership are enforced only on the watch path. Any user with a valid session can call the endpoint with an arbitrary video ID and manipulate engagement state on resources they are forbidden from viewing.

This pattern is a textbook Missing Authorization weakness [CWE-862], where an application performs authentication but omits per-resource authorization checks on a sensitive action.

Root Cause

The root cause is the absence of a permission check inside like.json.php before writing the like record. The endpoint trusts session state as sufficient proof of authorization instead of re-evaluating the target video's access policy. Access control logic is duplicated across the codebase rather than centralized, so playback restrictions are not inherited by interaction endpoints.

Attack Vector

An attacker authenticates to the AVideo instance with any valid low-privileged account. The attacker enumerates or guesses the numeric identifier of a password-protected or group-restricted video. The attacker then issues an HTTP request to the like.json.php endpoint with that video ID, causing the server to increment the like counter for content the account cannot watch.

While the direct impact is limited to integrity of engagement metrics and disclosure of the existence of restricted content, the flaw demonstrates a broader authorization gap that operators should treat as untrusted for any client-supplied video ID. For technical details, see the GitHub Security Advisory GHSA-5jgf-mc35-5wg5 and the VulnCheck Advisory.

// No verified exploitation code is available. Refer to the linked
// GitHub Security Advisory and VulnCheck advisory for technical details.

Detection Methods for CVE-2026-90546

Indicators of Compromise

Requests to like.json.php from authenticated sessions targeting video IDs that the same session has never requested via the watch or streaming endpoints.
Rapid sequential like submissions from a single account across a wide range of video IDs, indicating enumeration.
Anomalous growth in like counts on videos marked as password-protected or group-restricted in the AVideo database.

Detection Strategies

Correlate web server access logs to identify accounts that call like.json.php for videos without a prior successful playback authorization.
Alert on user accounts issuing likes against video IDs outside their permitted group memberships based on AVideo's access policy tables.
Review database records for like entries on restricted videos and cross-reference with the granting user's group and password-unlock history.

Monitoring Recommendations

Enable verbose access logging on the AVideo /plugin/ and root PHP endpoints, retaining logs long enough to reconstruct interaction sequences.
Forward web and application logs to a centralized analytics platform to baseline normal user interaction volumes and flag deviations.
Monitor for spikes in low-privileged account activity following account creation, which may indicate scripted abuse of the endpoint.

How to Mitigate CVE-2026-90546

Immediate Actions Required

Update WWBN AVideo to a commit that post-dates c3edcc274c389816d434acadac07ee78eaf330c1 and includes the authorization fix referenced in the vendor advisory.
Audit existing like records against restricted videos and remove entries that could not have originated from authorized viewers.
Restrict account registration on public instances until the patch is applied to reduce the pool of accounts capable of exploiting the flaw.

Patch Information

Refer to the GitHub Security Advisory GHSA-5jgf-mc35-5wg5 for the upstream fix and remediation guidance. Operators should track the WWBN AVideo repository for the corrective commit and deploy the updated code base across all instances.

Workarounds

Place the like.json.php endpoint behind a reverse proxy rule that restricts access to authenticated sessions with additional server-side validation.
Temporarily disable the like feature at the application layer by returning an error from like.json.php until the patch is deployed.
Enforce group and password-check middleware for all *.json.php interaction endpoints, not only the video playback route.

bash

# Example nginx rule to temporarily block the vulnerable endpoint
location = /like.json.php {
    return 403;
}