CVE-2026-90551: WWBN AVideo Auth Bypass Vulnerability

CVE-2026-90551 Overview

CVE-2026-90551 is a missing authorization vulnerability [CWE-862] in WWBN AVideo, an open-source video streaming platform. The video_from_program API endpoint fails to validate playlist ownership before returning results. Unauthenticated attackers can query the endpoint to enumerate private playlist names, owner information, and video titles. The exposure includes titles of password-protected content. The flaw affects WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1.

Critical Impact
Unauthenticated remote attackers can enumerate private playlist metadata and video titles across the platform, exposing content ownership relationships and password-protected resources without any credentials.

Affected Products

WWBN AVideo streaming platform
Deployments running commit c3edcc274c389816d434acadac07ee78eaf330c1 or earlier
Any instance exposing the video_from_program API endpoint to untrusted networks

Discovery Timeline

2026-09-12 - CVE-2026-90551 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90551

Vulnerability Analysis

The vulnerability resides in the video_from_program API endpoint of WWBN AVideo. The endpoint returns playlist and video data without checking whether the requesting user owns or has permission to view the referenced playlist. Because the check is absent rather than weak, no credential replay or token manipulation is required. An attacker simply sends API requests and iterates over playlist identifiers.

The returned data includes private playlist names, associated owner identifiers, and video titles. Password-protected videos still expose their titles through this endpoint, which defeats the confidentiality expectation of the password-protection feature. Attackers can build a complete inventory of otherwise-hidden content on an AVideo instance.

The issue is a Broken Access Control weakness classified under [CWE-862] Missing Authorization. It affects confidentiality only; integrity and availability remain unchanged. The Exploit Prediction Scoring System places the probability of exploitation at 0.236 percent.

Root Cause

The root cause is the absence of an ownership or visibility check inside the video_from_program handler. The endpoint queries the underlying data store for playlist contents and returns records directly, without filtering by session identity or playlist visibility flags. Private and password-protected content is treated the same as public content at the API layer.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker issues HTTP requests to the vulnerable API endpoint on an exposed AVideo host. By enumerating playlist identifiers, the attacker retrieves metadata for private playlists and titles of password-protected videos. Technical details are available in the GitHub Security Advisory and the VulnCheck Advisory on AVideo.

Detection Methods for CVE-2026-90551

Indicators of Compromise

Unauthenticated HTTP requests to the video_from_program API endpoint from a single source across many playlist identifiers.
Sequential or dictionary-style enumeration of playlist IDs in web server access logs.
Elevated response volume from the video_from_program route without corresponding authenticated session cookies.

Detection Strategies

Alert on requests to video_from_program that lack a valid authentication cookie or bearer token.
Correlate high-cardinality access to distinct playlist identifiers from a single client within a short window.
Monitor for user-agent strings associated with automated HTTP clients scraping the API surface.

Monitoring Recommendations

Enable verbose access logging on the AVideo web tier and forward logs to a centralized analytics platform.
Baseline normal request rates to playlist API endpoints and alert on deviation.
Track referer and origin headers to distinguish legitimate front-end traffic from direct API scraping.

How to Mitigate CVE-2026-90551

Immediate Actions Required

Restrict network access to the AVideo administrative and API surface using firewall or reverse-proxy access controls.
Apply the upstream fix once released by WWBN and rebuild affected containers or deployments.
Audit web server logs for prior enumeration activity against the video_from_program endpoint.

Patch Information

A patched commit was not identified in the enriched CVE data at time of publication. Operators should track the GitHub Security Advisory GHSA-7h47-x3h5-c8xq for fix availability and upgrade guidance. Deployments running commit c3edcc274c389816d434acadac07ee78eaf330c1 or earlier remain exposed until upgraded.

Workarounds

Block or rate-limit unauthenticated requests to /video_from_program at the reverse proxy or web application firewall.
Require an authenticated session cookie for all API routes that return playlist or video metadata.
Remove sensitive titles from password-protected videos until the fix is deployed, treating the title field as public metadata.

bash

# Example nginx rule to require an auth cookie on the vulnerable endpoint
location ~* /video_from_program {
    if ($cookie_PHPSESSID = "") {
        return 401;
    }
    proxy_pass http://avideo_backend;
}