CVE-2026-90545 in AVideo
Summary
by MITRE • 09/12/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the commentAddNew.json.php endpoint, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests with a valid session to add comments to videos they cannot watch, bypassing password and group access controls.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified in WWBN AVideo stems from an insufficient validation of access control mechanisms within the commentAddNew.json.php endpoint. This flaw allows authenticated users to circumvent security restrictions designed to limit video visibility based on passwords or group memberships. Specifically, while the application correctly restricts direct viewing and streaming of protected content, it fails to apply equivalent checks when processing requests to add comments to those same videos. This discrepancy creates a logical access control failure where the permission model for interaction is decoupled from the permission model for consumption.
From a technical perspective, this issue represents a classic case of broken access control at the application logic layer. When an authenticated user submits a POST request containing comment data via the affected endpoint, the server processes and stores the input without verifying whether the associated video resource requires authentication or group-based restrictions that the current session does not satisfy. The system assumes that if a user is logged in, they have implicit permission to interact with all resources linked to their account context, ignoring specific per-video access policies. This oversight enables attackers who possess valid credentials for any registered account to inject comments into videos intended for private or restricted audiences.
The operational impact of this vulnerability extends beyond simple unauthorized posting. It compromises the confidentiality and integrity expectations set by video owners who rely on password protection or group restrictions to control their content distribution. Attackers can use this capability to post malicious links, spam, defamatory material, or phishing attempts within comments visible only to a select audience, thereby exploiting trust relationships within private communities. Furthermore, it undermines the security boundary established by access controls, potentially leading to information leakage if comment metadata reveals sensitive details about restricted content that should remain hidden from unauthorized parties.
This vulnerability aligns with CWE-284 Improper Access Control and falls under MITRE ATT&CK technique T1078 Valid Accounts, as it exploits legitimate authentication credentials to bypass authorization checks. To mitigate this risk, developers must enforce consistent access control validation across all endpoints interacting with protected resources. The commentAddNew.json.php endpoint should perform a pre-processing check that verifies the requesting user's permissions against the specific video’s access rules before allowing any write operations. Additionally implementing strict input validation and ensuring that session context is rigorously mapped to resource-level permissions will prevent such logical bypasses. Regular security audits focusing on authorization logic in multi-tenant or permission-based applications are essential to identify similar discrepancies where read and write permissions diverge.