CVE-2026-90545

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1

Description Authenticated users can bypass password and group access controls to post comments on restricted videos. This occurs because the software fails to validate video access permissions when processing requests to the 'commentAddNew.json.php' endpoint. An attacker with a valid session can submit POST requests to add comments to videos they are not authorized to watch.

Recommendations Update WWBN AVideo to a version released after commit c3edcc274c389816d434acadac07ee78eaf330c1. As a temporary workaround, restrict access to the 'commentAddNew.json.php' endpoint to minimize the risk of unauthorized comment submission.