WWBN AVideo CVE-2026-59256

The Gallery plugin must be installed and its public endpoint (plugin/Gallery/view/sections.php) must be network-reachable by the attacker - this is the sole token-issuance pathway. The target restricted content must be protected exclusively by AVideo's native token-based authorization on view/hls.php; if additional authentication layers (e.g., web server HTTP Basic Auth, reverse proxy authentication) are in front of the HLS endpoint, those would independently block the attack. No authentication, elevated privileges, or user interaction are required for any step. Exploitation is limited to confidentiality - there is no mechanism in this vulnerability for code execution, data modification, or service disruption. Deployments where the Gallery plugin is disabled or where all hosted video content is already publicly accessible have no meaningful exposure.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) classifies this as a high-severity, remotely exploitable confidentiality breach with no authentication barrier and no meaningful complexity - a two-step operation that any unskilled attacker can replicate with a browser and curl. No CISA KEV entry is present and no public exploit code has been identified, placing this in the 'high CVSS, unconfirmed active exploitation' tier. EPSS data is absent from the available intelligence, so exploitation probability cannot be independently quantified; however, the trivial attack pattern means that low EPSS should not be taken as reassurance. The blast radius is bounded to confidentiality - there is no code execution or availability impact - but unauthorized video access can constitute a serious content licensing violation, copyright infringement liability, or privacy breach depending on what content the AVideo instance hosts. The risk is most acute for any AVideo deployment that hosts non-public video content and exposes the Gallery plugin to the internet; deployments with only fully public content or no internet-facing Gallery plugin have substantially reduced exposure.

An unauthenticated attacker sends a standard HTTP GET request to the public Gallery endpoint (plugin/Gallery/view/sections.php) and extracts a valid platform token from the response. The attacker replays that token in a crafted request to the restricted HLS video streaming endpoint (view/hls.php), which accepts it as a legitimate authorization credential and returns the protected video content. No exploit code has been identified at time of analysis, and the attack requires no special tooling beyond a standard HTTP client.