CVE-2026-90536

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1

Description An authorization failure exists in the 'adsInfo' API endpoint. Unauthenticated attackers can access this endpoint by providing the videos id parameter to retrieve password-protected video owner identifiers, including the owner's user ID and personalized ad creative URLs, without required permission checks.

Recommendations Update WWBN AVideo to a version released after commit c3edcc274c389816d434acadac07ee78eaf330c1. As a temporary workaround, restrict access to the 'adsInfo' API endpoint to minimize the risk of exploitation.