Missing Authorization Vulnerability in WWBN AVideo through 29.7.1
CVE-2026-126545

5.3MEDIUM

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126545?

AVideo versions up to 29.7.1 are affected by a missing authorization vulnerability in the get_api_tags() function. This flaw enables authenticated users to bypass restrictions and access sensitive video data. By subscribing to a tag and querying the API, attackers can retrieve filenames, titles, and video passwords for unlisted and password-protected content. This issue poses a significant risk to user privacy and data security, allowing unauthorized viewing of restricted videos.

Affected Version(s)

AVideo 0 <= 29.7.1

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-3...
vendor-advisory
https://github.com/WWBN/AVideo/commit/a8d1e0e484d65555642...
patch
https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/API/AP...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AlpetGexha
.