CVE-2026-90549 in AVideo
Sumário
de MITRE • 12/09/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to properly authorize access to the videosAndroid.json.php endpoint, allowing unauthenticated guests to list password-protected videos with sensitive owner information. Attackers can retrieve video metadata including owner email, lastLogin, filename, and hashId by sending an unauthenticated GET request to the endpoint.
If you want to get best quality of vulnerability data, you may have to visit VulDB.