CVE-2026-85155

WWBN AVideo, an open-source self-hosted video platform, fails to properly sanitize the sort column parameter passed to get.json.php when APIName=channels, enabling SQL injection by unauthenticated attackers. Because the API orders its results by the attacker-supplied column, an attacker can sort by sensitive database columns such as users.password and users.recoverPass and use the resulting ordering as an oracle to infer password hashes and password-recovery tokens, or deliberately trigger SQL errors that disclose the full query statement and database schema. Any AVideo deployment exposing this endpoint, typically internet-facing video portals, is affected; the exact affected version range and fixed release are not specified in the available data. No exploitation has been reported: there is no known public proof-of-concept, the flaw is not in CISA's KEV, and its EPSS score of 0.3% (19th percentile) indicates low predicted near-term exploitation risk.

What to do: Upgrade AVideo to the latest available release once a patched build is published, as no fixed version is stated in the available data. In the interim, restrict access to get.json.php (e.g., allow only trusted networks) and apply WAF rules that reject sort/order-by values containing unquoted identifiers or SQL keywords. Review access logs for unauthenticated requests to get.json.php?APIName=channels that reference users.password or users.recoverPass, and rotate password-recovery tokens if suspicious activity is found.