WWBN AVideo CVE-2026-90538

The playlistsFromUser.json.php endpoint must be network-reachable, which is the default configuration for any public-facing AVideo deployment. The attacker must supply a valid userId value belonging to a target account; knowledge or enumeration of user IDs (often sequential integers on AVideo instances) is a prerequisite. Exploitation is strictly read-only and scoped to private playlist metadata (Favorite and Watch Later list titles/contents) - no credential exposure, account takeover, content modification, or availability impact is possible through this vector. Instances deployed behind authentication-enforcing reverse proxies or restricted to authenticated users only are not exposed to unauthenticated exploitation of this endpoint.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) scores 6.9, reflecting network-accessible unauthenticated exploitation with low confidentiality impact scoped only to the vulnerable system. The practical impact is bounded to private playlist metadata - titles and membership of Favorite and Watch Later lists - rather than video content, authentication credentials, or any write-capable abuse path. The vulnerability is not in CISA KEV, no EPSS data is available, and no public exploit code is confirmed, suggesting opportunistic rather than targeted exploitation risk at present. Even a mid-sized municipal IT team in leszno running a public AVideo instance should treat the ease of exploitation (no authentication, low complexity, direct network access) as a meaningful privacy concern for their users, particularly since user ID enumeration is often trivial on platforms with sequential or guessable identifiers. The absence of integrity or availability impact keeps this below critical triage thresholds, but the privacy exposure for users trusting the platform's access controls is concrete.

An attacker targeting a public AVideo instance enumerates valid user IDs (often sequential integers) and issues unauthenticated HTTP GET requests to /playlistsFromUser.json.php?userId=<target_id>, receiving private Favorite and Watch Later playlist titles in the JSON response. No authentication token, session cookie, or special tooling is required - a single curl command against the publicly accessible endpoint suffices. No public POC has been confirmed, but the attack surface is straightforward given the endpoint path and parameter are documented in the advisory.