CVE-2026-58002

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to commit 9c39d8c8b4c1f75540788d6b391740852ceb0732

Description An authorization bypass exists that allows authenticated users to forge two-party consent records. This is achieved by supplying the counterparty's agreement timestamp to the 'Users affiliations add.json.php' endpoint. An attacker can create a forged affiliation with the status variable set to 'a', subsequently allowing them to reassign video ownership to arbitrary users via the 'videoAddNew.json.php' endpoint, which relies on the forged affiliation for authorization.

Recommendations Update WWBN AVideo to commit 9c39d8c8b4c1f75540788d6b391740852ceb0732 or a newer version.