Missing Authorization Flaw in WWBN AVideo's Playlist Management

CVE-2026-90538

What is CVE-2026-90538?

The WWBN AVideo software contains a missing authorization vulnerability within the playlistsFromUser.json.php component. This issue allows unauthenticated attackers to gain access to private user playlists, including 'Favorites' and 'Watch Later' playlists. The vulnerability arises from improper cache key management, which leads to request conflation across different user contexts. Consequently, attackers can exploit this flaw by manipulating requests and retrieving sensitive information belonging to other users.

References