CVE-2026-90542 in AVideo
Summary
by MITRE • 09/12/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate that logged-in users can access live schedules before creating reminders via remindMe.json.php. Authenticated attackers can create scheduler reminders for private live schedules they cannot view and learn the private schedule title from the generated email job.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified in WWBN AVideo, specifically linked to commit c3edcc274c389816d434acadac07ee78eaf330c1, represents a critical access control flaw within the platform's reminder scheduling subsystem. This issue stems from an insufficient validation mechanism when handling requests processed by the remindMe.json.php endpoint. While the application correctly restricts direct viewing of private live schedules based on user permissions and ownership settings, it fails to enforce equivalent checks during the creation phase for scheduler reminders. Consequently, any authenticated user can submit a request to create a reminder associated with a specific live schedule ID without first verifying whether that user possesses the necessary privileges to view or interact with that particular schedule. This architectural inconsistency between resource consumption and resource access control creates a significant security gap that allows unauthorized information disclosure through indirect channels.
From a technical perspective, the flaw resides in the logic governing the reminder creation workflow. When an authenticated attacker initiates a request to remindMe.json.php, the backend processes the input parameters which include identifiers for live schedules. The system generates email jobs based on these inputs without cross-referencing them against the user's permission matrix or ownership records associated with private content. This lack of server-side authorization check means that the application trusts client-supplied data regarding schedule accessibility implicitly during this specific operation. By exploiting this weakness, an attacker can successfully register reminders for live streams that are designated as private and inaccessible to their account. The system proceeds to queue these tasks without raising an error or denying access, thereby treating unauthorized requests with the same procedural legitimacy as authorized ones.
The operational impact of this vulnerability is primarily centered on information disclosure and privacy violation. Although attackers cannot directly view the video content or stream data associated with private schedules, they can infer sensitive details about those schedules through the automated email notifications generated by the reminder system. When a reminder job is created for a private live schedule, the resulting email often contains metadata such as the title of the scheduled event. This allows authenticated users to enumerate and discover the existence and titles of private content that should remain hidden from them. In environments where privacy is paramount, such as educational institutions or corporate internal networks using AVideo, this capability undermines trust in the platform's security model. It enables malicious actors to map out the structure of private events, potentially identifying high-value targets for further exploitation or social engineering attacks based on the revealed titles and timing information.
This vulnerability aligns with CWE-284, which describes Improper Access Control, as it involves a failure to enforce proper authorization checks before performing an action that reveals restricted data. Furthermore, from the perspective of the MITRE ATT&CK framework, this behavior is indicative of T1078, Valid Accounts, where attackers leverage legitimate credentials to access resources they are not explicitly permitted to view, and potentially relates to T1539, Steal Web Session Cookie, if combined with other techniques, though here it primarily facilitates reconnaissance via information leakage. The attack vector requires authentication, meaning the threat actor must already have a valid account on the system, which limits the scope but increases the severity for internal threats or compromised accounts.
To mitigate this vulnerability, developers must implement strict server-side authorization checks within the remindMe.json.php endpoint logic before any reminder jobs are queued. This involves verifying that the authenticated user requesting the reminder has explicit read access to the specified live schedule ID. If the schedule is private and the user lacks ownership or designated viewing permissions, the system should reject the request immediately with an appropriate error code rather than proceeding to create the email job. Additionally, input validation should ensure that only valid, existing schedule IDs are processed, preventing enumeration attempts through invalid identifiers. Regular security audits of access control logic across all API endpoints are recommended to identify similar inconsistencies where action permissions diverge from resource visibility permissions. Patching this issue requires updating the application code to enforce consistent authorization policies throughout the entire lifecycle of a reminder request, ensuring that privacy settings for live schedules are respected at every stage of interaction.