CVE-2026-90547

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1

Description The Bookmark plugin fails to validate user permissions, allowing unauthenticated attackers to read chapter names from password-protected videos. By querying the 'getBookmarks.json.php' endpoint with a video ID parameter, an attacker can retrieve sensitive chapter metadata without providing authentication or password verification.

Recommendations Update to a version released after commit c3edcc274c389816d434acadac07ee78eaf330c1. Restrict access to the 'getBookmarks.json.php' endpoint to minimize the risk of exploitation.