CVE-2026-90552 in AVideo
Summary
by MITRE • 09/12/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the Playlists_schedules/list.json.php and Live/calendar.json.php endpoints, allowing authenticated and unauthenticated users to read private playlist schedule metadata. Attackers with canStream privileges or no authentication can retrieve schedule names, descriptions, timestamps, and playlist identifiers by querying these endpoints without ownership checks.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified in WWBN AVideo represents a critical failure in access control mechanisms within the application's API layer, specifically affecting the handling of private playlist schedules. This flaw stems from insufficient validation of resource ownership during requests to specific JSON endpoints, namely Playlists_schedules/list.json.php and Live/calendar.json.php. In secure software architecture, any endpoint that returns sensitive or restricted data must enforce strict authorization checks to ensure that the requesting user has legitimate rights to access the requested resources. However, in this instance, the application logic fails to verify whether the authenticated user initiating the request is the actual owner of the playlist schedule being queried. This oversight allows for unauthorized information disclosure, as the system returns metadata associated with private playlists regardless of the requester's relationship to that content.
The technical nature of this flaw classifies it under CWE-284, which describes Improper Access Control, and more specifically aligns with CWE-639 regarding Authorization Bypass Through User-Controlled Key if the playlist identifier is manipulated, though here the primary issue is the lack of ownership verification for valid identifiers. From a threat modeling perspective using the MITRE ATT&CK framework, this vulnerability facilitates Reconnaissance activities, particularly Data from Information Repositories or Discovery of Private Resources. An attacker can leverage these endpoints to gather intelligence about other users' content strategies, scheduling patterns, and private organizational structures without needing elevated privileges beyond basic streaming capabilities or even no authentication at all in certain configurations.
The operational impact of this vulnerability is significant for both individual creators and enterprise deployments using AVideo. Since authenticated users with the canStream privilege are affected, any user who registers on a public instance gains the ability to scrape private schedule data from other accounts. Furthermore, the fact that unauthenticated users can also exploit these endpoints means that even anonymous visitors to the platform can harvest this metadata. The exposed information includes playlist names, descriptions, timestamps, and unique playlist identifiers. This leakage compromises the privacy expectations of content creators who intend their schedules to be visible only to themselves or specific authorized audiences. It potentially enables targeted attacks against high-profile channels by revealing when they plan to upload sensitive material or organizing malicious campaigns around known private events.
Mitigation strategies must focus on implementing robust server-side authorization checks within the affected PHP files. Developers should ensure that every request to Playlists_schedules/list.json.php and Live/calendar.json.php verifies that the user ID associated with the current session matches the owner ID of the requested playlist schedule before returning any data. Additionally, input validation should be reinforced to prevent enumeration attacks where attackers iterate through playlist IDs to harvest metadata from multiple sources. It is also recommended to implement rate limiting on these endpoints to mitigate automated scraping efforts. For immediate remediation, applying the patch associated with commit c3edcc274c389816d434acadac07ee78eaf330c1 is essential, as it addresses this specific logic gap in access control enforcement.