WWBN AVideo CVE-2026-90540

Exploitation requires a valid authenticated account on the AVideo instance (PR:L); anonymous exploitation is not possible. The target video must be configured as password-protected within AVideo. The attacker must know or enumerate the video ID of a restricted video they do not have watch permissions for. The attacker must own at least one playlist on the same instance. Limiting factors include: the attacker cannot view, stream, or download the protected video content through this path - only add a reference to it in their playlist; exploitation impact is therefore bounded by whether playlist contents are visible to other users or shared externally. Default AVideo deployments exposing the web interface over the network are affected without further special configuration.

The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) is broadly appropriate: exploitation requires valid credentials (PR:L) and yields only low integrity impact (VI:L), with no confidentiality or availability consequences. EPSS data is not provided in the input, and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation. The POC status is unknown. Even a mid-sized municipal IT team in tczew running an internal AVideo instance should treat this as a low-urgency but legitimate access-control gap: password-protected video content can be surfaced in unauthorized user playlists, potentially exposing metadata or enabling downstream sharing in deployment contexts where playlist contents are visible to third parties. The practical blast radius is constrained - attackers cannot view or download the protected video directly through this vector, only reference it within a playlist they control - but in environments where content segregation is a security requirement (licensed media, internal-only recordings), the integrity violation carries meaningful business risk beyond the raw CVSS score.

An authenticated AVideo user identifies the numeric ID of a password-protected video they lack credentials to watch - discoverable via sequential ID enumeration or platform search features. The attacker submits a direct POST request to playListAddVideo.json.php with the target video ID and one of their own playlist IDs. The server adds the video to the playlist without checking watch permissions, allowing the attacker to reference the restricted video in a playlist context they control.