WWBN AVideo: 25 Authorization, XSS, and File Access Vulnerabilities Disclosed Together
WWBN AVideo platform hit by 25 vulnerabilities, including critical flaws in authorization, XSS, and file access, disclosed September 11-12, 2026.
Key findings
- 25 vulnerabilities disclosed for WWBN AVideo between Sep 11-12, 2026, ranging from medium to high severity.
- Many flaws stem from insufficient authorization and permission checks, allowing unauthorized access to private content and data.
- Stored XSS vulnerabilities found in Bookmark, CustomizeUser, and YPTWallet plugins, alongside profile fields.
- High-severity flaws include unauthenticated file reads, script injection, and access to sensitive scheduler data.
- Commit c3edcc274c389816d434acadac07ee78eaf330c1 addresses a significant portion of these vulnerabilities; users must update.
On September 11-12, 2026, a batch of 25 vulnerabilities was disclosed for WWBN's AVideo platform. These vulnerabilities, primarily affecting authorization and input validation, range in severity from medium to high, with several critical flaws carrying a CVSSv3 score of 8.7. The disclosures highlight a pattern of insecure handling of user-supplied data and insufficient permission checks across various endpoints and plugins, potentially exposing private content, enabling unauthorized actions, and allowing for script injection.
A significant portion of the disclosed vulnerabilities stem from a failure to properly validate ownership or permissions in API endpoints. For instance, CVE-2026-90551, CVE-2026-90550, CVE-2026-90549, and CVE-2026-90548 detail how unauthenticated attackers can access private playlist contents, video metadata, image gallery files, and owner information due to missing authorization checks in endpoints like video_from_program.php, mediaSession.json.php, videosAndroid.json.php, and ImageGallery list.json.php respectively. Similarly, CVE-2026-90552 and CVE-2026-90547 point to issues in Playlists_schedules/list.json.php and like.json.php, allowing unauthorized access to private playlist schedules and the ability to like restricted videos.
Several vulnerabilities also impact core functionalities and plugins, including live streaming and user interactions. CVE-2026-90543, a missing authentication vulnerability in the Live plugin's socketMessageLiveOwner.json.php, allows attackers to interact with live streams without proper authorization. The Bookmark plugin is affected by CVE-2026-89256, a stored XSS vulnerability where chapter names are not properly encoded, allowing malicious scripts to be injected. Another stored XSS vulnerability, CVE-2026-89254, exists in the CustomizeUser plugin due to unsanitized field_name parameters. Furthermore, CVE-2026-89253 highlights an XSS vulnerability in the user 'donationLink' profile field, where improper validation allows for script injection.
The batch also includes vulnerabilities related to data enumeration and modification. CVE-2026-90541 and CVE-2026-90539, affecting the TopMenu plugin's menus.json.php and menuItems.json.php endpoints, allow unauthenticated attackers to retrieve all menu data, including inactive and admin-only items. CVE-2026-90538, a missing authorization vulnerability in playlistsFromUser.json.php, permits unauthenticated users to access private playlists belonging to other users. CVE-2026-89252 describes an insecure direct object reference (IDOR) in addLiveLink.php, enabling authenticated users to modify other users' live stream links.
High-severity flaws were also present, including CVE-2026-90537, which allows unauthenticated attackers to access scheduler email jobs via a site-wide daily token, potentially exposing private live stream details. CVE-2026-89250, an unauthenticated file read vulnerability in getRecordedFile.php, allows attackers to download recorded live video files. Finally, CVE-2026-89249, a stored XSS in the YPTWallet plugin, allows administrators to inject malicious scripts when viewing withdrawal requests.
The vulnerabilities were patched by commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier versions of AVideo are affected. Users are advised to update to a patched version to mitigate these security risks. The broad nature of these vulnerabilities, affecting multiple plugins and core functionalities, underscores the importance of thorough security audits and robust input validation for all AVideo installations.
The commit hash c3edcc274c389816d434acadac07ee78eaf330c1 appears to be the fix for many of these issues. Users should ensure their AVideo installation is updated beyond this commit. The range of vulnerabilities, from information disclosure to stored XSS and unauthorized access, indicates a systemic issue with authorization and input sanitization in the affected versions of AVideo.
The disclosure of these 25 vulnerabilities together highlights a significant security event for AVideo users. The common theme across many of these CVEs is the failure to properly validate user permissions and ownership before accessing or modifying sensitive data. This allowed both authenticated and unauthenticated users to bypass intended restrictions.
Specific plugins like Bookmark, Live, TopMenu, CustomizeUser, AD_Server, and YPTWallet were found to have vulnerabilities. This suggests that the security issues are not confined to the core AVideo platform but extend to its extensible plugin architecture.
The severity of the vulnerabilities ranges from medium (CVSSv3 4.3) to high (CVSSv3 8.7). The high-severity flaws, in particular, pose a significant risk, enabling actions like arbitrary file reads, stored XSS, and unauthorized access to sensitive scheduler information.
The commit hash c3edcc274c389816d434acadac07ee78eaf330c1 is repeatedly mentioned as the fix for many of these vulnerabilities. This indicates that a single update or series of updates addressing this commit should resolve a large number of the disclosed issues.
Given the number of vulnerabilities and their varied impact, it is crucial for all AVideo administrators to review their current version and apply the necessary patches promptly to protect their platforms and user data. The lack of proper authorization checks in numerous endpoints is a critical concern that needs immediate attention.
The vulnerabilities were disclosed on September 11-12, 2026. This tight disclosure window suggests a coordinated effort by security researchers or a single discovery event. The breadth of the issues points to potential systemic weaknesses in the development practices for the affected AVideo versions.
The commit hash c3edcc274c389816d434acadac07ee78eaf330c1 is identified as the fix for many of these vulnerabilities. This implies that updating to a version that incorporates this commit will address a significant portion of the security concerns.
The vulnerabilities collectively represent a serious risk to AVideo installations, potentially leading to data breaches, unauthorized content access, and platform compromise. Administrators are urged to prioritize updating their systems.
The disclosure of 25 vulnerabilities in AVideo, ranging from medium to high severity, occurred between September 11-12, 2026. Many of these issues stem from inadequate authorization checks and input validation across various API endpoints and plugins.
The commit c3edcc274c389816d434acadac07ee78eaf330c1 is identified as the fix for a substantial number of these vulnerabilities, indicating that updating to a version incorporating this commit is crucial for remediation.
Key affected areas include unauthorized access to private content (playlists, videos, images), information disclosure (user data, menu items), stored cross-site scripting (XSS) vulnerabilities, and insecure direct object references (IDOR).
The high-severity vulnerabilities, such as CVE-2026-89256, CVE-2026-89254, CVE-2026-89253, CVE-2026-90537, CVE-2026-89250, and CVE-2026-89249, pose the most significant risks, enabling script injection, arbitrary file reads, and access to sensitive scheduler data.
Users are strongly advised to update their AVideo installations to a version that includes the fix referenced by commit c3edcc274c389816d434acadac07ee78eaf330c1 to mitigate these security risks. The broad impact across multiple plugins necessitates a comprehensive update.