by Kastro
Paper/Archive/CVE-2026-86190

CVE-2026-86190

WWBN AVideo — WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter

EPSS 0.4%public exploitCVSS 9.3
critical.is priorityof 100
46
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 38.6.386 × 207.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session identifier to hijack viewer sessions, including administrator accounts, and obtain sensitive personal data for all video viewers.

Affected

ProductAffectedFixed inSource
AVideo≤ 29.0–CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/WWBN/AVideo/security/advisories/GHSA-82q2-88mq-p44qwriteupvulncheck.com/advisories/wwbn-avideo-broken-access-control-via-videoviewsinfo-hash-parameter