CVE-2026-90548: WWBN AVideo Information Disclosure Flaw

CVE-2026-90548 Overview

CVE-2026-90548 is a missing authorization vulnerability in WWBN AVideo, an open-source video streaming and content management platform. The flaw resides in the ImageGallery list.json.php endpoint, which fails to validate user permissions before returning gallery metadata. Unauthenticated attackers can query the endpoint to enumerate filenames and URLs of password-protected image galleries. Once file paths are exposed, attackers retrieve the underlying images directly without authentication, bypassing the intended access control on private galleries. The issue is tracked under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Unauthenticated remote attackers can enumerate and download files from password-protected image galleries hosted on affected AVideo instances.

Affected Products

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
AVideo deployments exposing the ImageGallery plugin endpoints to the internet
Self-hosted AVideo streaming platform installations

Discovery Timeline

2026-09-12 - CVE-2026-90548 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90548

Vulnerability Analysis

The vulnerability affects the list.json.php endpoint of the AVideo ImageGallery plugin. The endpoint returns a JSON structure containing metadata for gallery items, including filenames and URLs. Under normal operation, galleries can be marked as password-protected so only authorized viewers can enumerate and load their contents.

The endpoint does not enforce this restriction server-side. Any HTTP client can request the JSON listing without a session, credentials, or the gallery password. The response reveals the paths of every image the plugin manages, including those in restricted collections.

Because the underlying image files are served from predictable web-accessible locations, an attacker who knows the URL retrieves each file directly. The password gate is applied only on the front-end viewer, not on the file storage or the metadata API.

Root Cause

The root cause is a missing authorization check in the ImageGallery listing endpoint. The handler enumerates gallery records without evaluating gallery visibility, session state, or password acceptance. This is a classic broken access control pattern in which sensitive metadata is exposed by an unauthenticated API while the corresponding UI enforces access.

Attack Vector

The attack is remote, unauthenticated, and requires no user interaction. An attacker issues an HTTP GET request to the vulnerable list.json.php endpoint on an exposed AVideo instance. The response contains filenames and URLs for every gallery, including private ones. The attacker then issues follow-up requests to each URL to retrieve the image content.

No exploit code or public proof-of-concept is currently listed in ExploitDB or CISA KEV. Details of the flaw are documented in the WWBN AVideo GitHub Security Advisory and the VulnCheck advisory for AVideo.

Detection Methods for CVE-2026-90548

Indicators of Compromise

Unauthenticated HTTP GET requests to /plugin/ImageGallery/list.json.php or equivalent ImageGallery endpoints in web server access logs.
Bursts of sequential requests from a single source IP fetching image URLs returned by the listing endpoint.
Requests to gallery image paths that are not preceded by an authenticated session or a password-submission POST.

Detection Strategies

Parse web server logs for requests to list.json.php under the ImageGallery plugin path that return HTTP 200 without an authenticated session cookie.
Alert on user-agents or IPs that request the JSON listing followed by many direct image downloads within a short interval.
Correlate access to private gallery image files with the absence of a preceding password validation request.

Monitoring Recommendations

Enable verbose access logging on the AVideo web tier and forward logs to a central SIEM for retention and correlation.
Baseline normal request volume to ImageGallery endpoints and alert on deviations that suggest scraping.
Monitor egress bandwidth from the AVideo host for anomalous spikes consistent with bulk image exfiltration.

How to Mitigate CVE-2026-90548

Immediate Actions Required

Upgrade AVideo to a build later than commit c3edcc274c389816d434acadac07ee78eaf330c1 once a fixed release is published by WWBN.
Restrict access to the ImageGallery plugin endpoints at the reverse proxy or WAF, requiring authentication before the request reaches PHP.
Audit existing password-protected galleries and rotate or remove any assets that must remain confidential until a patch is applied.

Patch Information

WWBN maintains security fixes through the AVideo GitHub repository. Refer to the WWBN AVideo GitHub Security Advisory GHSA-vr35-39vf-9qp9 for the authoritative fix commit and upgrade instructions. Operators tracking main should redeploy from a commit that includes the authorization check on list.json.php.

Workarounds

Block unauthenticated access to /plugin/ImageGallery/list.json.php at the reverse proxy or web application firewall.
Move sensitive image assets out of the AVideo videos/ web-accessible directory until the endpoint is patched.
Disable the ImageGallery plugin in the AVideo admin console if it is not required for production workloads.

bash

# Nginx snippet to block unauthenticated access to the vulnerable endpoint
location ~* /plugin/ImageGallery/list\.json\.php$ {
    # Require an authenticated session cookie or return 403
    if ($cookie_PHPSESSID = "") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}