CVE-2026-59256

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to commit 9c39d8c8

Description An authorization bypass exists where the getToken() function creates tokens that are not bound to a specific user identity or purpose. The endpoint 'plugin/Gallery/view/sections.php' issues these valid tokens to unauthenticated visitors. An attacker can obtain a token from the Gallery endpoint and use it to bypass authorization checks in other subsystems, such as the 'view/hls.php' endpoint, to gain unauthorized access to restricted video content.

Recommendations Update WWBN AVideo to a version including commit 9c39d8c8 or later.