CVE-2026-92577: AVideo Auth Bypass Vulnerability

CVE-2026-92577 Overview

CVE-2026-92577 is a broken access control vulnerability in AVideo through version 29.0. The flaw resides in the get_api_video API endpoint, specifically within the clean_title branch. The endpoint returns user-group-restricted videos to unauthenticated callers when queried by their public slug. Along with the restricted video metadata, the response leaks owner personally identifiable information (PII) including email, phone, address, birth date, and administrator status. The issue is tracked as an Insecure Direct Object Reference weakness [CWE-639].

Critical Impact
Anonymous attackers can bypass user-group video restrictions and harvest owner PII, including administrator status, by querying the get_api_video endpoint using public video slugs.

Affected Products

AVideo (WWBN) through version 29.0
API endpoint get_api_video with clean_title parameter
All deployments exposing the AVideo REST API to untrusted networks

Discovery Timeline

2026-09-16 - CVE CVE-2026-92577 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92577

Vulnerability Analysis

The vulnerability exists in AVideo's REST API surface, which exposes the get_api_video endpoint for retrieving video metadata. The endpoint accepts multiple lookup modes, one of which resolves videos by their clean_title slug. The slug branch does not enforce the same access control checks applied to user-group-restricted content. As a result, videos intended only for members of specific user groups are returned to any anonymous caller that knows or guesses the public slug.

The response payload compounds the impact by including full owner records rather than a minimal public projection. Sensitive fields such as email, phone number, physical address, date of birth, and the administrator flag are exposed. Attackers can enumerate slugs, harvest PII at scale, and identify privileged accounts to prioritize follow-on attacks.

Root Cause

The root cause is a missing authorization check on the clean_title code path within get_api_video. Authorization logic that gates other lookup branches is not applied consistently, and the response serializer returns owner PII without filtering by caller privilege. This pattern maps directly to [CWE-639: Authorization Bypass Through User-Controlled Key].

Attack Vector

Exploitation requires only network access to the AVideo instance. An attacker issues an HTTP request to the get_api_video endpoint supplying a clean_title value that corresponds to a restricted video. The server returns the video record along with the owner's PII. No authentication, user interaction, or elevated privileges are required. Refer to the GitHub Security Advisory GHSA-w59h-5r8w-686r and the VulnCheck AVideo Access Control Advisory for full technical detail.

Detection Methods for CVE-2026-92577

Indicators of Compromise

Anonymous HTTP requests to /plugin/API/get.json.php or equivalent routes invoking get_api_video with a clean_title parameter.
API responses to unauthenticated sessions containing user fields such as email, phone, address, birthDate, or isAdmin.
High-volume slug enumeration from a single source IP or user agent against the video API.

Detection Strategies

Inspect web server and application logs for get_api_video calls that include clean_title and lack an authenticated session cookie or bearer token.
Alert on API responses whose size or field set exceeds the expected public projection for video metadata.
Correlate slug-based lookup requests with subsequent access to administrative or user profile endpoints from the same client.

Monitoring Recommendations

Forward AVideo access logs and reverse-proxy logs into a centralized analytics pipeline for query-based hunting.
Track baseline request rates against get_api_video and flag anomalous spikes indicative of enumeration.
Monitor egress data volume from the AVideo host for signs of bulk PII exfiltration.

How to Mitigate CVE-2026-92577

Immediate Actions Required

Upgrade AVideo to a release later than 29.0 that includes the fix referenced in GHSA-w59h-5r8w-686r.
Restrict network exposure of the get_api_video endpoint to authenticated users where operationally feasible.
Audit historical API logs for prior unauthenticated access to restricted videos and notify affected users if PII was exposed.

Patch Information

Refer to the upstream advisory GitHub Security Advisory GHSA-w59h-5r8w-686r for the fixed version and commit references. Apply the vendor patch to enforce authorization on the clean_title branch and to remove owner PII from the API response.

Workarounds

Deploy a web application firewall (WAF) rule that blocks unauthenticated requests to get_api_video when the clean_title parameter is present.
Place the AVideo API behind an authenticating reverse proxy so anonymous callers cannot reach the vulnerable endpoint.
Temporarily disable or rename the API plugin route if the endpoint is not required for public consumption.

bash

# Example nginx rule to block unauthenticated clean_title lookups
location ~ /plugin/API/get\.json\.php {
    if ($arg_APIName = "video") {
        set $block "1";
    }
    if ($arg_clean_title != "") {
        set $block "${block}1";
    }
    if ($http_cookie !~ "PHPSESSID") {
        set $block "${block}1";
    }
    if ($block = "111") {
        return 403;
    }
}