CVE-2026-86190

WWBN AVideo, a self-hosted video streaming platform, suffers from a broken access control flaw (CWE-200) in its videoViewsInfo endpoints. When an unauthenticated caller supplies a hash parameter, the endpoint returns complete user records, including password hashes, password recovery tokens, and live session identifiers. An attacker can use the disclosed session identifier to hijack viewer sessions, including administrator accounts, and can harvest password hashes and recovery tokens plus sensitive personal data for all video viewers. Any publicly reachable AVideo deployment exposing these endpoints is affected. No public proof-of-concept or confirmed exploitation is known; EPSS puts 30-day exploitation probability at 0.3% (19th percentile) and the issue is not in CISA KEV.

What to do: Update WWBN AVideo to the latest release incorporating the vendor fix once published, as no specific fixed version is stated in the available data. Until patched, restrict or block unauthenticated access to the videoViewsInfo endpoints (e.g., via a WAF rule matching the hash parameter) and review logs for anonymous calls to those endpoints. As a precaution, force password resets and invalidate active sessions and recovery tokens, since hashes and live session identifiers may already have been exposed.