WWBN AVideo CVE-2026-90537

Exploitation requires three concurrent conditions: (1) the target AVideo instance has the Scheduler plugin installed and active with at least one configured email job; (2) at least one Live page on the instance is accessible without authentication, allowing the attacker to retrieve the site-wide daily token; and (3) the /plugin/Scheduler/sendEmail.json.php endpoint is reachable over the network. If Live pages are authentication-gated, the attacker cannot obtain a valid daily token and exploitation is blocked unless they already hold a user account (reducing the PR:N premise). The daily token rotates on a 24-hour cycle, creating a time-bounded reuse window per token. Deployments with no active Scheduler email jobs reduce the confidentiality impact to near zero even if the endpoint is reachable.

The CVSS 4.0 score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N) is broadly appropriate: the attack is remote, low-complexity, and the PR:N designation holds when Live pages are publicly accessible - the condition on which the effective privilege requirement rests. The confidentiality impact (VC:H) is justified by the disclosure of subscriber email addresses and private content metadata. The integrity impact (VI:L) reflects the ability to trigger bulk email sends from the platform's mail infrastructure, which could be abused for spam or phishing from a trusted sender domain. EPSS probability data is absent from the input, preventing exploitation-frequency comparison. No KEV listing and no public exploit code has been identified, suggesting limited real-world exploitation activity at time of analysis. Real-world risk is moderate-to-high for deployments with public Live pages and active Scheduler jobs; materially lower for instances where Live pages require login or the Scheduler plugin is unused.

An attacker visits a publicly accessible AVideo Live page and extracts the site-wide daily token embedded in the page source or API response. They then send a crafted HTTP GET or POST request to /plugin/Scheduler/sendEmail.json.php supplying the harvested token, enumerating all scheduled email jobs, exfiltrating subscriber email addresses and private live-stream titles, and optionally triggering bulk email sends from the platform's configured mail infrastructure. No user account or persistent session is required; the daily token rotation limits reuse to within its 24-hour validity window.