What is the CVSS score of CVE-2026-90549?

CVE-2026-90549 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.2%.

WWBN AVideo CVE-2026-90549

EUVD-2026-76867 MEDIUM

Information Exposure (CWE-200)

2026-09-12 VulnCheck

GHSA-3v44-r7wj-3fcq

PHP Information Disclosure Avideo Wwbn

6.9

CVSS 4.0 · Vendor: VulnCheck

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify network-reachable AVideo instance
Delivery

Send unauthenticated GET to /videosAndroid.json.php
Exploit

Missing authorization check bypassed
Execution

Parse JSON response
Impact

Harvest owner emails, lastLogin, filenames, hashIds

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions - remote unauthenticated exploitation against default configurations of WWBN AVideo. The endpoint videosAndroid.json.php is accessible via a standard GET request with no authentication token, session cookie, or API key required. Exploitation is limited to AVideo instances that are network-reachable to the attacker (internet-facing or within the attacker's network segment). The impact is bounded to video metadata and owner account fields (email, lastLogin, filename, hashId); code execution and write access are not achievable through this vector alone. Password-protected video content files themselves are not directly retrieved - only their metadata is exposed.
Impact	The CVSS 4.0 score of 6.9 (VC:L, no integrity or availability impact) accurately characterizes this as a moderate-severity privacy/information-disclosure issue rather than a critical system-compromise vector. The AV:N/AC:L/AT:N/PR:N/UI:N metrics indicate the attack is entirely trivial - an unauthenticated GET request with no special conditions - meaning automated scraping at scale is feasible for any internet-facing AVideo instance. The confidentiality impact is correctly rated Low (VC:L) because exposure is bounded to video metadata and owner account details rather than credential hashes, session tokens, or file system content. No EPSS score was provided in the input data, so exploitation probability cannot be quantified precisely. No KEV listing and no confirmed public POC, reducing urgency relative to actively exploited issues. The meaningful risk profile is: PII harvesting (owner emails, login timestamps) across publicly accessible instances, and partial deanonymization of video owners who expected password protection to conceal their identity. Installations handling sensitive or private video content face the greatest exposure.
Exploit ScenarioDerived	An attacker identifies a publicly accessible AVideo instance and sends an unauthenticated HTTP GET request to /videosAndroid.json.php. The endpoint returns a JSON payload listing password-protected videos along with owner email addresses, last login timestamps, filenames, and hashIds, exposing PII for all video owners on the platform without any credential or session requirement.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 12, 2026

Unauthenticated information disclosure in WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 exposes password-protected video metadata to anonymous remote attackers via a missing authorization check on the videosAndroid.json.php endpoint. Any unauthenticated guest can retrieve sensitive owner data - including email addresses, last login timestamps, filenames, and hashIds - with a trivial GET request, bypassing the password-protection intent entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication, zero-complexity attack surface makes opportunistic mass harvesting straightforward.

RemediationAI

Apply the fix described in GitHub Security Advisory GHSA-frrh-5hwx-jggr (https://github.com/WWBN/AVideo/security/advisories/GHSA-frrh-5hwx-jggr), which addresses the missing authorization on the videosAndroid.json.php endpoint. An exact patched release version is not confirmed in the available input data; administrators should update to a commit after c3edcc274c389816d434acadac07ee78eaf330c1 once a tagged release is published. As an immediate compensating control, restrict access to videosAndroid.json.php at the web server or reverse proxy layer - for example via Nginx location deny rules or Apache mod_authz - requiring valid session authentication before the request reaches PHP. Note that this workaround may break Android client functionality for legitimate users if not paired with a pass-through for authenticated sessions. If the Android client feature is not in use, disabling or removing the endpoint entirely eliminates the attack surface with no functional impact.

Affected VersionsENISA

AVideo 0 ≤c3edcc274c389816d434acadac07ee78eaf330c1

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

WWBN AVideo is a PHP-based self-hosted video sharing platform (CPE: cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*). The affected endpoint, videosAndroid.json.php, is designed to serve video listings to Android clients and returns JSON-structured metadata. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) as catalogued, though the underlying mechanism is more precisely CWE-862 (Missing Authorization): the endpoint performs no caller identity or session validation before returning data. The response includes owner PII (email address, lastLogin), content identifiers (filename, hashId), and password-protected video listings - data that should be gated behind at minimum session or token authentication. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L reflects a fully network-exploitable, zero-friction exposure with limited but real confidentiality impact.

Know when Avideo gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

vuln.today AI 5.3 MEDIUM

Unauthenticated network GET with no interaction; confidentiality is Low as only video metadata (not credentials or files) is exposed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

None

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to properly authorize access to the videosAndroid.json.php endpoint, allowing unauthenticated guests to list password-protected videos with sensitive owner information. Attackers can retrieve video metadata including owner email, lastLogin, filename, and hashId by sending an unauthenticated GET request to the endpoint.

Threat Intelligence Overview

EPSS Score

0.2%

Top 89% exploitable

Prevalence

Low

niche self-hosted PHP video platform, limited enterprise footprint

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +34

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.