CVE-2026-92586: AVideo Authorization Bypass Vulnerability

CVE-2026-92586 Overview

CVE-2026-92586 is a missing authorization vulnerability [CWE-862] in AVideo through version 29.0, an open-source video streaming platform maintained by WWBN. The set_api_comment function fails to verify whether an authenticated user has permission to view a target video before accepting a comment submission. Authenticated attackers can send POST requests to the comment API endpoint with arbitrary video IDs. This lets them post comments on password-protected or group-restricted videos they otherwise cannot watch. The flaw is confined to the commenting workflow and does not disclose video content, but it undermines the access control model enforced elsewhere in the application.

Critical Impact
Authenticated users can bypass video access restrictions to write comments on password-protected and group-restricted content through the comment API endpoint.

Affected Products

AVideo (WWBN) through version 29.0
Vulnerable commit: c3edcc274c389816d434acadac07ee78eaf330c1
Deployments exposing the comment API endpoint to authenticated users

Discovery Timeline

2026-09-16 - CVE-2026-92586 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-92586

Vulnerability Analysis

AVideo enforces access controls on videos through password protection and group-based restrictions. These controls gate the ability to watch a video and interact with its metadata. The set_api_comment function, which handles new comment submissions through the API, does not re-check these access controls against the target video ID supplied in the request. Any authenticated user of the platform can therefore address a comment to any video in the catalog, regardless of restriction status. The vulnerability is a server-side authorization gap rather than a client-side UI issue, so it cannot be corrected by hiding the comment interface in the web frontend.

Root Cause

The root cause is a missing authorization check [CWE-862] in the comment submission handler. The function trusts the video ID parameter in the incoming POST request and writes the comment record without invoking the permission checks used by the video playback path. Password verification and group membership evaluation are simply not called from this code path.

Attack Vector

An attacker registers or uses an existing low-privilege account on the AVideo instance. They enumerate or guess the numeric ID of a restricted video, then submit a crafted POST request to the comment API endpoint with that ID and comment body. The server accepts the submission and stores the comment, which becomes visible to other users with access to the video. See the GitHub Security Advisory and the Vulncheck Advisory on AVideo for the affected code path.

Detection Methods for CVE-2026-92586

Indicators of Compromise

Comment records associated with password-protected or group-restricted videos submitted by user accounts that lack view permissions on those videos.
POST requests to the comment API endpoint from user sessions immediately following failed or absent playback requests for the same video ID.
Unusual sequential enumeration of video IDs in comment submissions from a single account.

Detection Strategies

Correlate application logs to identify comment submissions where the submitting user has no corresponding successful video view event for the target video ID.
Review web server access logs for authenticated POST traffic to the comment endpoint that skips prior GET requests to the video page.
Audit the comments database to flag entries where the commenter's group membership does not match the video's access group.

Monitoring Recommendations

Enable verbose logging on the AVideo API layer to capture user ID, target video ID, and access decision for every comment submission.
Alert on spikes in comment submissions per authenticated user, which may indicate scripted enumeration.
Forward AVideo application and web server logs to a centralized log platform for correlation and retention.

How to Mitigate CVE-2026-92586

Immediate Actions Required

Upgrade AVideo to a version later than 29.0 that includes the fix referenced in the GitHub Security Advisory.
Restrict registration on public-facing AVideo instances if upgrade cannot be applied immediately.
Audit existing comments on password-protected and group-restricted videos and remove entries submitted by unauthorized accounts.

Patch Information

The vulnerability is present through AVideo 29.0 at commit c3edcc274c389816d434acadac07ee78eaf330c1. Consult the GitHub Security Advisory GHSA-fm4f-q895-8jhc for the fixed release and patch commit that adds the missing access check to set_api_comment.

Workarounds

Disable the comment feature globally in AVideo configuration until the patched version is deployed.
Place the comment API endpoint behind a web application firewall rule that denies requests from users whose session lacks view rights to the referenced video ID.
Limit comment submissions to trusted user roles by adjusting group permissions on the AVideo instance.

bash

# Example WAF rule concept: block comment API POSTs from accounts
# without a prior successful video view in the same session
# (adapt to your WAF syntax; not a drop-in configuration)
SecRule REQUEST_METHOD "@streq POST" \
  "chain,phase:2,deny,status:403,id:1092586,\
   msg:'AVideo CVE-2026-92586 comment authorization check'"
  SecRule REQUEST_URI "@contains /objects/comment" \
    "chain"
    SecRule &SESSION:viewed_video_ids "@eq 0"