CVE-2026-90546

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1

Description Logged-in users can record likes on password-protected and group-restricted videos because the software fails to validate video access permissions in the 'like.json.php' endpoint. This allows attackers to submit like requests for videos they are not authorized to watch, resulting in the increment of like counters and a bypass of access controls.

Recommendations Update WWBN AVideo to a version released after commit c3edcc274c389816d434acadac07ee78eaf330c1. As a temporary workaround, restrict access to the 'like.json.php' endpoint to minimize the risk of exploitation.