CVE-2026-90547 in AVideo
Summary
by MITRE • 09/12/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the Bookmark plugin getBookmarks.json.php endpoint, allowing unauthenticated attackers to read chapter names from password-protected videos. Attackers can query the endpoint with a video ID parameter to retrieve sensitive chapter metadata without authentication or password verification.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified in WWBN AVideo stems from an insufficient access control mechanism within the Bookmark plugin, specifically affecting the getBookmarks.json.php endpoint. This flaw represents a classic case of broken object level authorization where the application fails to properly validate whether the requesting user has permission to access specific resources. In this scenario, the server-side logic processes requests for bookmark data associated with video chapters without verifying if the requester is authenticated or holds the necessary privileges to view content marked as password-protected. This oversight allows unauthenticated actors to bypass security controls that are otherwise enforced during standard video playback or page rendering, effectively creating a direct path to sensitive metadata.
From a technical perspective, the exploitation vector involves sending HTTP requests to the getBookmarks.json.php endpoint with a specific video ID parameter. Because the application does not check for valid session tokens, API keys, or password credentials before returning data, an attacker can simply supply the identifier of any protected video and receive its associated chapter names in JSON format. This behavior indicates that the authorization logic is either missing entirely from this code path or relies on client-side checks that are trivially bypassed by direct API interaction. The absence of server-side validation for resource ownership or access rights means that the confidentiality of the metadata is compromised regardless of the video's protection status.
The operational impact of this vulnerability centers on information disclosure and potential privacy violations. Chapter names often contain descriptive text, timestamps, or contextual clues about the content within a password-protected video. For platforms hosting sensitive educational material, corporate training videos, or private user-generated content, exposing these metadata elements can reveal proprietary strategies, confidential business processes, or personal details that users intended to keep hidden. While this does not directly expose the video stream itself, it degrades the security posture by leaking structural information about protected assets and may aid attackers in further reconnaissance efforts against other parts of the platform.
This vulnerability aligns with CWE-284 Improper Access Control, as the system fails to restrict access to resources based on user identity or privileges. It also maps to MITRE ATT&CK technique T1078 Valid Accounts if authentication were required but bypassed, though in this specific case of unauthenticated access, it more closely resembles T1539 Steal Web Session Cookie if session data was involved, or generally falls under Information Exposure through improper validation. The lack of permission checks on a public-facing API endpoint is a critical design flaw that undermines the intended security model of the application.
To mitigate this issue, developers must implement strict server-side authorization checks for all endpoints handling sensitive resource metadata. Specifically, the getBookmarks.json.php script should verify that the requesting user is authenticated and possesses explicit permission to view bookmarks for the specified video ID before returning any data. If a video is marked as password-protected or private, access to its associated bookmark data must be denied unless valid credentials are provided and validated against the resource's security policy. Additionally, implementing rate limiting on this endpoint can help prevent automated enumeration attacks that seek to harvest metadata from multiple protected videos in bulk. Regular code audits focusing on object-level authorization patterns are recommended to identify similar flaws across other plugins or endpoints within the AVideo ecosystem.