WWBN AVideo CVE-2026-90544

Exploitation requires a valid authenticated session on the AVideo instance (PR:L - any registered user account suffices, no administrative privileges needed). The vulnerability is most meaningful when the AVideo deployment uses access-controlled or private videos - if all content is publicly accessible, the authorization bypass has no practical boundary to cross. The endpoint videoAddViewCount.json.php must be reachable over the network; deployments behind authenticated reverse proxies or internal-only network configurations reduce exposure to the internal user population. There is no requirement for special configuration settings, specific PHP versions, or particular AVideo plugins beyond the core platform.

The real-world risk of CVE-2026-90544 is low to moderate. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable exploitation requiring only a standard authenticated session - no elevated privileges needed. The impact is strictly integrity-limited (VI:L), with no confidentiality or availability consequences. EPSS data is absent from the provided intelligence, and the vulnerability is not listed in CISA KEV, nor is public exploit code confirmed. Practically speaking, even a mid-sized municipal IT team in tczew managing a community AVideo deployment should treat this as a low-priority backlog item rather than an emergency, given the attacker cannot read restricted video content, cannot access credentials, and cannot cause downtime - only corrupt view statistics. The primary business risk is artificial inflation of engagement metrics on access-controlled videos, which could affect recommendation algorithms or content licensing analytics in commercially-operated AVideo deployments.

An attacker with a low-privilege AVideo account - for instance a registered viewer - identifies the ID of a private or restricted video they cannot legitimately watch. They then submit repeated POST requests to videoAddViewCount.json.php with the target video ID, causing the platform to increment view counts and watch-time totals as if the video had been viewed. No public exploit code is confirmed, but exploitation requires only basic HTTP request crafting with a valid session cookie.