CVE-2026-90547: WWBN AVideo Information Disclosure Flaw

CVE-2026-90547 Overview

CVE-2026-90547 is a missing authorization vulnerability [CWE-862] in WWBN AVideo, an open-source video streaming platform. The flaw resides in the Bookmark plugin's getBookmarks.json.php endpoint, which fails to validate user permissions before returning data. Unauthenticated attackers can query the endpoint with a video ID parameter to retrieve chapter names from password-protected videos. The issue affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1.

Critical Impact
Remote unauthenticated attackers can read chapter metadata from password-protected videos, bypassing the platform's access controls and exposing information the video owner intended to restrict.

Affected Products

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
AVideo Bookmark plugin (getBookmarks.json.php endpoint)
Deployments serving password-protected video content

Discovery Timeline

2026-09-12 - CVE-2026-90547 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90547

Vulnerability Analysis

The vulnerability exists in the AVideo Bookmark plugin, specifically in the getBookmarks.json.php endpoint. This endpoint returns bookmark and chapter data associated with a video referenced by a supplied video identifier. The endpoint does not check whether the requesting user is authenticated. It also does not verify whether the user has supplied the password required to view a protected video.

As a result, an anonymous HTTP request that includes a valid video ID returns chapter names for videos the requester should not be able to access. While the exposure is limited to bookmark and chapter metadata rather than the video stream itself, the leaked information can reveal titles, topics, and section names that the owner explicitly restricted.

Root Cause

The root cause is missing authorization logic in a JSON API endpoint. The Bookmark plugin trusts the video ID parameter and queries the underlying data store without evaluating the video's access policy. Password-protected videos have a distinct access requirement, but the endpoint enforces neither authentication nor password validation before returning chapter metadata.

Attack Vector

Exploitation requires only network access to the AVideo instance. An attacker sends an HTTP GET request to the getBookmarks.json.php endpoint with a videos_id parameter corresponding to a target video. The server responds with chapter data in JSON format regardless of the video's protection status. No credentials, tokens, or user interaction are required.

The vulnerability is described in prose here because no verified proof-of-concept code has been published. Refer to the GitHub Security Advisory and the VulnCheck Advisory on AVideo for further technical details.

Detection Methods for CVE-2026-90547

Indicators of Compromise

Unauthenticated HTTP requests to /plugin/Bookmark/getBookmarks.json.php in web server access logs
Repeated requests iterating through sequential videos_id values from a single source address
Requests to the endpoint without preceding authentication or session cookies
Anomalous JSON response traffic originating from the Bookmark plugin endpoint

Detection Strategies

Alert on any external, unauthenticated access to the getBookmarks.json.php endpoint
Correlate access to the endpoint with the target video's protection status to identify unauthorized reads
Deploy WAF rules that require valid session cookies before allowing requests to Bookmark plugin endpoints

Monitoring Recommendations

Ingest AVideo web server logs into a centralized logging platform for query and alerting
Track baseline request volume to /plugin/Bookmark/ paths and flag sudden increases
Monitor for user agents and IP ranges commonly associated with automated scanners hitting the endpoint

How to Mitigate CVE-2026-90547

Immediate Actions Required

Update AVideo to a commit newer than c3edcc274c389816d434acadac07ee78eaf330c1 once an upstream fix is available
Restrict access to /plugin/Bookmark/getBookmarks.json.php at the reverse proxy or WAF layer
Audit web server logs for prior unauthenticated access to the endpoint

Patch Information

At publication, the vulnerability is tracked in the GitHub Security Advisory GHSA-xv29-q875-59jq. Administrators should apply upstream commits that add authorization checks to the Bookmark plugin as soon as they are released. Consult the advisory for the specific commit hashes that remediate the issue.

Workarounds

Block requests to /plugin/Bookmark/getBookmarks.json.php at the reverse proxy for unauthenticated sessions
Disable the Bookmark plugin in the AVideo administration panel if it is not required
Enforce authentication on all /plugin/Bookmark/ endpoints via server configuration rules

bash

# Example nginx rule to require an authenticated session cookie
location = /plugin/Bookmark/getBookmarks.json.php {
    if ($cookie_PHPSESSID = "") {
        return 403;
    }
    try_files $uri =404;
}