CVE-2026-90550 Overview
CVE-2026-90550 is a missing authorization vulnerability in WWBN AVideo, an open-source video streaming platform. The flaw resides in the PlayerSkins/mediaSession.json.php endpoint, which returns video metadata without verifying the requester's authorization. Unauthenticated attackers can query the endpoint with a video ID parameter to retrieve titles of password-protected videos along with owner email addresses. The issue affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 and is classified under [CWE-200] Information Exposure.
Critical Impact
Remote unauthenticated attackers can enumerate protected video titles and harvest owner email addresses from affected AVideo instances.
Affected Products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
- AVideo PlayerSkins/mediaSession.json.php endpoint
- Deployments exposing the AVideo web interface to untrusted networks
Discovery Timeline
- 2026-09-12 - CVE-2026-90550 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-90550
Vulnerability Analysis
The vulnerability originates in the mediaSession.json.php endpoint within the AVideo PlayerSkins component. The endpoint accepts a video identifier as a request parameter and returns JSON metadata describing the requested media. AVideo permits publishers to restrict individual videos with passwords, so metadata such as title and owner should only be exposed to authorized viewers.
The endpoint does not enforce this authorization check. Any HTTP client that supplies a valid video ID receives the metadata payload regardless of authentication state or the video's access controls. The disclosed fields include the video title and the associated account owner's email address, which enables reconnaissance and targeted phishing against platform operators.
Root Cause
The root cause is missing authorization logic before data retrieval. The endpoint proceeds directly from request parsing to database lookup and response serialization without invoking AVideo's session, ownership, or password-gate validation. See the GitHub Security Advisory for maintainer notes.
Attack Vector
Exploitation requires only network access to the AVideo instance. An attacker enumerates or guesses numeric video IDs and issues HTTP GET requests to the mediaSession.json.php endpoint. Each successful response leaks the title and owner email of a protected video, allowing bulk harvesting through simple scripting. No user interaction, credentials, or elevated privileges are required. Additional technical context is available in the Vulncheck Advisory on AVideo.
Detection Methods for CVE-2026-90550
Indicators of Compromise
- Repeated unauthenticated HTTP requests to /plugin/PlayerSkins/mediaSession.json.php from a single source
- Sequential or scripted enumeration of the videos_id query parameter across a wide numeric range
- Web server access logs showing high-volume 200 OK responses to the endpoint with no accompanying session cookie
Detection Strategies
- Monitor web server and reverse-proxy logs for anomalous request rates against the mediaSession.json.php endpoint
- Alert on unauthenticated requests that return metadata for videos marked as password-protected in the AVideo database
- Correlate outbound scraping patterns with subsequent phishing attempts targeting harvested owner email addresses
Monitoring Recommendations
- Ingest AVideo web logs into a centralized log platform and baseline normal traffic to the PlayerSkins plugin
- Rate-limit or block source IPs performing rapid ID enumeration against video metadata endpoints
- Review email gateway telemetry for phishing addressed to AVideo owner accounts as a downstream indicator
How to Mitigate CVE-2026-90550
Immediate Actions Required
- Upgrade AVideo to a build that includes the fix released after commit c3edcc274c389816d434acadac07ee78eaf330c1
- Restrict access to the AVideo administrative and plugin endpoints from untrusted networks where feasible
- Audit web logs for prior enumeration activity against mediaSession.json.php and notify affected video owners
Patch Information
Refer to the GitHub Security Advisory GHSA-g79r-wg9m-3fh3 for the upstream fix and version guidance. Apply the maintainer-provided patch or upgrade to the next release that enforces authorization on the PlayerSkins/mediaSession.json.php endpoint.
Workarounds
- Block or restrict access to /plugin/PlayerSkins/mediaSession.json.php at the web server or WAF layer until a patch is applied
- Enforce authentication in front of the AVideo application using a reverse proxy for internal deployments
- Remove or disable the PlayerSkins plugin if it is not required by the deployment
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.