Medium severity5.3NVD Advisory· Published Sep 12, 2026· Updated Sep 15, 2026
CVE-2026-90547
CVE-2026-90547
Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the Bookmark plugin getBookmarks.json.php endpoint, allowing unauthenticated attackers to read chapter names from password-protected videos. Attackers can query the endpoint with a video ID parameter to retrieve sensitive chapter metadata without authentication or password verification.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
2News mentions
1- WWBN AVideo: 25 Authorization, XSS, and File Access Vulnerabilities Disclosed TogetherVypr Intelligence · Sep 12, 2026