CVE-2026-86190 in AVideo
Summary
by MITRE • 09/05/2026
WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session identifier to hijack viewer sessions, including administrator accounts, and obtain sensitive personal data for all video viewers.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in WWBN AVideo represents a critical failure in server-side access control mechanisms within the application's API layer. Specifically, the flaw resides in the handling of requests directed at the videoViewsInfo endpoints. Under normal operational conditions, these endpoints are designed to return aggregated or anonymized view statistics for content creators and administrators. However, due to insufficient validation of input parameters, specifically when a hash parameter is supplied by the client, the application bypasses standard authentication checks. This logic error allows unauthenticated users to retrieve complete user records from the database. The data exposed includes highly sensitive information such as plaintext or hashed passwords, account recovery tokens, and active live session identifiers for all video viewers registered on the platform.
From a technical perspective, this issue stems directly from improper object level access control where the application fails to verify that the requesting entity has permission to view specific user data based on their authentication status. The presence of the hash parameter acts as an unintended vector that triggers a code path which omits security checks. This is not merely a case of information leakage but constitutes a severe breach of confidentiality and integrity for user accounts. By obtaining valid session identifiers, an attacker can perform session hijacking attacks without needing to crack password hashes or exploit other authentication bypasses. The ability to impersonate any viewer, including those with administrative privileges, elevates this vulnerability from a data exposure risk to a full system compromise vector.
The operational impact of this vulnerability is profound and multifaceted. First, the disclosure of recovery tokens allows attackers to reset passwords for targeted accounts, effectively taking over user identities even if strong password policies are in place. Second, the availability of live session identifiers enables real-time account takeover attacks where an attacker can inject their own browser cookies or headers into a victim's active session. This is particularly dangerous because it bypasses multi-factor authentication mechanisms that rely on initial login verification rather than continuous session validation. For administrators, this means complete control over the platform, allowing for further exploitation such as defacement, data exfiltration of entire user bases, or installation of persistent backdoors within the application codebase.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. In terms of offensive security frameworks, it maps directly to MITRE ATT&CK technique T1078 Valid Accounts, specifically the sub-technique for hijacking valid sessions or credentials. The exploitation path involves initial reconnaissance followed by direct API manipulation to harvest sensitive data and session tokens, which are then used to maintain unauthorized access.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Immediately, developers should enforce strict authentication requirements on all internal API endpoints regardless of the parameters provided. Input validation logic must be reviewed to ensure that specific parameter values do not trigger alternative code paths that bypass security middleware. Implementing rate limiting can also help mitigate automated scraping attempts while a patch is deployed. Long term solutions include adopting a principle of least privilege for database queries, ensuring that user data retrieval functions always require explicit authorization checks against the current session's permissions. Additionally, implementing secure session management practices such as rotating session identifiers upon privilege changes and binding sessions to specific client fingerprints can reduce the effectiveness of session hijacking attacks even if tokens are partially exposed. Regular security audits focusing on API endpoint access controls are essential to prevent similar logic flaws from recurring in future updates.