A critical broken access control flaw in WWBN AVideo lets unauthenticated attackers pull complete user records, including password hashes, recovery tokens, and live session IDs, from the videoViewsInfo endpoints.
What Is It
CVE-2026-86190 is a broken access control vulnerability in WWBN AVideo's videoViewsInfo endpoints, classified as CWE-200 (information disclosure). When a hash parameter is supplied, the endpoints return complete user records to unauthenticated callers. Those records include password hashes, account recovery tokens, and live session identifiers.
It carries a CVSS 3.1 base score of 9.1 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, and a CVSS 4.0 score of 9.3 (Critical). Network attack vector, low complexity, no privileges, no user interaction.
Note that the CWE assignment and the scored vector do not fully agree: CWE-200 describes a read-only disclosure, but the published CVSS 3.1 vector rates integrity impact as High (I:H). Operators should not assume the impact is confined to reading data until the upstream advisory clarifies which characterization is correct.
Why It Matters
The leaked session identifier is the sharp end of this. Rather than cracking the disclosed password hashes, an attacker who obtains a live session ID would likely be able to replay it to hijack the corresponding viewer session; potentially including administrator accounts. If that path works as the disclosed data suggests, an unauthenticated read becomes account takeover. The available material does not confirm whether session validation elsewhere in the application constrains this, so treat the chain as plausible rather than demonstrated.
Beyond takeover, the disclosure exposes sensitive personal data for every viewer of a video. Recovery tokens in the same response could give an attacker a second, persistent path back into accounts even after sessions are rotated.
No authentication, no user interaction, and a trivially low attack complexity mean this is reachable by anyone who can send an HTTP request to an exposed instance.
What's Vulnerable
- Vendor: WWBN
- Product: AVideo
- Affected versions: all versions up to and including 29.0 (default status for other versions: unaffected)
No CPE match data is present in the NVD record at this time.
Patch Status
No CISA KEV entry for this CVE was identified in the material reviewed for this brief, and no federal required-action deadline is known. That is not a confirmation of the CVE's KEV status either way, and it is not evidence that exploitation is absent; check the KEV catalog directly before relying on it for prioritization. Exploit maturity in the CVSS 4.0 vector is NOT_DEFINED.
The NVD record is in Received status (published 2026-09-05, source [email protected]) and contains no explicit fixed-version or remediation statement. Because all versions through 29.0 are affected, operators should consult the upstream GitHub security advisory below for fix availability and treat any internet-exposed instance at or below 29.0 as vulnerable.
Sources
- WWBN AVideo GitHub Security Advisory (GHSA-82q2-88mq-p44q), https://github.com/WWBN/AVideo/security/advisories/GHSA-82q2-88mq-p44q
- VulnCheck Advisory; https://www.vulncheck.com/advisories/wwbn-avideo-broken-access-control-via-videoviewsinfo-hash-parameter
- NVD, CVE-2026-86190