WWBN AVideo CVE-2026-90545

Exploitation requires a valid authenticated user session on the target AVideo instance (PR:L confirmed by CVSS vector). The targeted videos must have password protection or group-restricted access configured by an administrator - videos with no access controls are not meaningfully affected. The flaw exclusively grants the ability to write comments; the attacker gains no capability to view restricted video content, enumerate group members, or escalate privileges. Default AVideo deployments with commenting enabled and restricted-video configurations present are vulnerable. Limiting factors: requires active login credentials on the instance, yields only low integrity impact (comment pollution with no data exfiltration), and provides no path to reading or managing restricted content.

The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N with VI:L only) accurately captures a bounded, low-severity integrity issue. No EPSS data is available in the provided intelligence. This vulnerability is neither in CISA KEV nor is public exploit code identified at time of analysis, consistent with its low practical harm ceiling. Real-world impact is strictly comment pollution on restricted content - the attacker gains no access to the video itself, no credential data, and cannot affect availability. Risk priority is low for most deployments unless comment moderation is a security-sensitive workflow or spoofed comments could mislead users into revealing passwords or group membership. The 'Authentication Bypass' tag in the source metadata overstates the issue: exploitation requires an authenticated session and only crosses an authorization boundary, not an authentication one, which may cause analysts to misread triage priority.

An authenticated AVideo user without access to a password-protected video submits a POST request directly to commentAddNew.json.php, supplying their valid session cookie and the target video's identifier. The endpoint accepts the submission without querying the video's access controls, and the comment is written to the restricted video's thread. No public exploit code is known, and the attack is limited to users who already hold valid credentials on the platform.