CVE-2026-90544

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1

Description Authenticated attackers can increment view counts and watch-time on videos they are not permitted to access. This occurs because the software fails to validate video access permissions in the 'videoAddViewCount.json.php' endpoint before updating view statistics, allowing requests to be submitted with arbitrary video IDs.

Recommendations Update WWBN AVideo to a version released after commit c3edcc274c389816d434acadac07ee78eaf330c1. As a temporary workaround, restrict access to the 'videoAddViewCount.json.php' endpoint.