Access Control Flaw in WWBN AVideo Allows Unauthorized Video Additions

CVE-2026-90540

What is CVE-2026-90540?

WWBN AVideo contains a flaw in the authorization checks within the playListAddVideo.json.php endpoint. This vulnerability allows authenticated attackers to exploit insufficient permission validation when adding videos to their playlists. By providing the video ID and playlist ID parameters, attackers can include password-protected videos they should not have access to, jeopardizing the integrity of user playlists and exposing sensitive content. This incident highlights the importance of robust permission checks in video streaming applications.

References