CVE-2026-90549 in AVideo
Summary
by MITRE • 09/12/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to properly authorize access to the videosAndroid.json.php endpoint, allowing unauthenticated guests to list password-protected videos with sensitive owner information. Attackers can retrieve video metadata including owner email, lastLogin, filename, and hashId by sending an unauthenticated GET request to the endpoint.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified in WWBN AVideo stems from a critical failure in access control mechanisms within the application's backend architecture. Specifically, the endpoint videosAndroid.json.php lacks proper authorization checks for sensitive operations that should be restricted to authenticated users or administrators. This flaw allows unauthenticated guests to interact with functionality intended only for authorized personnel, leading to an unauthorized disclosure of private data. The root cause lies in the absence of session validation or token verification before processing requests directed at this specific API endpoint, which is designed to serve metadata and video information to Android clients but inadvertently exposes internal server logic to external actors without authentication requirements.
From a technical perspective, the exploitation involves sending an unauthenticated HTTP GET request directly to the videosAndroid.json.php path. Because the application does not verify whether the requester has valid credentials or appropriate permissions before executing the query against the database, it proceeds to retrieve and return video metadata associated with password-protected content. This includes sensitive owner information such as email addresses, last login timestamps, filenames, and unique hash identifiers. The exposure of these fields is particularly severe because they can be used for further reconnaissance attacks, including credential stuffing or targeted phishing campaigns against the identified users.
The operational impact of this vulnerability extends beyond simple data leakage. By obtaining a list of password-protected videos along with their owners' contact information, attackers gain significant insight into the user base and content structure of the platform. This can facilitate social engineering attacks where adversaries impersonate support staff or use leaked email addresses to send malicious payloads disguised as legitimate notifications. Additionally, the exposure of lastLogin times allows attackers to identify active users who may be more likely to respond to phishing attempts. The availability of filenames and hashIds also aids in correlating data across different systems if similar identifiers are used elsewhere, potentially leading to broader system compromise.
This issue aligns with CWE-284 Improper Access Control, as the application fails to enforce proper restrictions on unauthenticated users accessing protected resources. It is also closely related to CWE-601 URL Redirection to Untrusted Site in terms of how endpoints are exposed without adequate validation, though primarily it represents a direct access control bypass. In the context of the MITRE ATT&CK framework, this vulnerability supports reconnaissance activities under techniques such as T1592 Gather Victim Host Information and T1589 Collect Email Addresses, enabling adversaries to build profiles of potential victims for subsequent exploitation phases.
Mitigation strategies should focus on implementing robust authentication checks at the API level before any data retrieval occurs. Developers must ensure that all endpoints handling sensitive metadata require valid session tokens or API keys verified against active user sessions. Additionally, input validation and role-based access control policies should be enforced to restrict access based on user privileges rather than just endpoint availability. Regular security audits and penetration testing are recommended to identify similar gaps in other parts of the application where authorization checks may have been overlooked during development.