CVE-2026-90549: WWBN AVideo Information Disclosure Flaw

CVE-2026-90549 Overview

CVE-2026-90549 is a missing authorization vulnerability in WWBN AVideo, an open-source video streaming platform. The flaw affects the videosAndroid.json.php endpoint through commit c3edcc274c389816d434acadac07ee78eaf330c1. The endpoint fails to enforce access controls, allowing unauthenticated guests to enumerate password-protected videos. Attackers retrieve sensitive metadata including owner email addresses, lastLogin timestamps, filenames, and hashId values. The vulnerability is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
Unauthenticated remote attackers can harvest owner email addresses, login timestamps, and video identifiers from password-protected content, enabling targeted phishing and account takeover reconnaissance.

Affected Products

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
AVideo instances exposing the videosAndroid.json.php endpoint
Deployments serving password-protected video content

Discovery Timeline

2026-09-12 - CVE-2026-90549 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90549

Vulnerability Analysis

The vulnerability resides in the videosAndroid.json.php endpoint of WWBN AVideo. This endpoint returns JSON-formatted video listings intended for the platform's Android client integration. The server-side logic omits authentication and authorization checks before returning results. As a consequence, any unauthenticated HTTP client can query the endpoint and receive video records that include password-protected content. The response body exposes owner-identifying fields such as email addresses and last-login timestamps, along with filename and hashId values used to reference individual video assets.

Root Cause

The root cause is a broken access control condition on a JSON API route. The endpoint enumerates videos from the underlying database without first validating whether the caller has a session, an API token, or permission to view password-protected entries. Owner metadata is serialized directly into the response payload rather than being filtered based on the requester's identity. Refer to the GitHub Security Advisory for the maintainer analysis.

Attack Vector

Exploitation requires only network reachability to the AVideo web server. An attacker issues an unauthenticated HTTP GET request to videosAndroid.json.php and parses the returned JSON. No credentials, prior interaction, or elevated privileges are required. The disclosed hashId values can be reused against other AVideo endpoints to reference specific videos, and the harvested email and lastLogin data supports targeted phishing or credential-stuffing campaigns. See the VulnCheck Advisory on AVideo for additional exploitation context.

No verified proof-of-concept code is available; consult the referenced advisories for further technical detail.

Detection Methods for CVE-2026-90549

Indicators of Compromise

Unauthenticated HTTP GET requests to /videosAndroid.json.php in web server access logs
Requests to the endpoint originating from non-mobile user agents or automated scanners
Repeated or paginated queries against the endpoint from a single source address
Outbound JSON responses containing owner email addresses and hashId fields sent to unauthenticated clients

Detection Strategies

Review Apache, Nginx, or PHP-FPM access logs for GET /videosAndroid.json.php requests lacking session cookies or authorization headers
Correlate endpoint access with follow-on requests referencing exposed hashId values
Deploy web application firewall rules that flag or block anonymous access to the endpoint

Monitoring Recommendations

Enable verbose HTTP request logging on AVideo hosts and forward logs to a central SIEM
Alert on spikes in traffic volume to videosAndroid.json.php beyond expected mobile-client baselines
Monitor for enumeration patterns such as sequential requests or high request rates from single IPs

How to Mitigate CVE-2026-90549

Immediate Actions Required

Restrict public access to videosAndroid.json.php at the reverse proxy or web application firewall until a patched build is deployed
Audit the endpoint's access logs for prior unauthenticated retrieval and assume owner metadata is compromised
Rotate any credentials associated with exposed owner accounts and notify affected users of potential phishing risk

Patch Information

The vulnerability affects WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1. Administrators should track the GitHub Security Advisory for the official fix commit and upgrade to a build that enforces authorization on the videosAndroid.json.php endpoint.

Workarounds

Block or require authentication for /videosAndroid.json.php using reverse proxy rules (Nginx location block or Apache <Location> directive)
Restrict the endpoint to source IP ranges used by trusted mobile clients where feasible
Remove or disable the endpoint on deployments that do not require the Android client integration

bash

# Nginx configuration example: block unauthenticated access to the endpoint
location = /videosAndroid.json.php {
    deny all;
    return 403;
}