CVE-2026-90540

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1

Description An authorization issue exists when adding videos to playlists. The application fails to validate watch permissions in the 'playListAddVideo.json.php' endpoint. Authenticated attackers can add password-protected videos that they are not authorized to view to playlists they own by providing the video ID and playlist ID parameters.

Recommendations Update WWBN AVideo to a version released after commit c3edcc274c389816d434acadac07ee78eaf330c1. Restrict access to the 'playListAddVideo.json.php' endpoint to minimize the risk of exploitation.