CVE-2026-90537

WWBN AVideo, a self-hosted open-source video streaming platform, fails to enforce authorization on plugin/Scheduler/sendEmail.json.php, allowing unauthenticated attackers to interact with scheduler email jobs (CWE-862). The only requirement is a site-wide daily token, which attackers can obtain from publicly accessible Live pages. Once authorized by the token, an attacker can enumerate scheduler jobs, read private live stream titles and user email addresses, and trigger email sending from the platform. Any AVideo deployment running code through commit c3edcc274c389816d434acadac07ee78eaf330c1 is affected, especially instances that expose Live or Scheduler plugin pages to the internet. No public proof-of-concept is known and the flaw is not listed in CISA's KEV, so exploitation has not been confirmed in the wild.

What to do: Update AVideo to a build newer than commit c3edcc274c389816d434acadac07ee78eaf330c1 as soon as a patched release is available, ensuring plugin/Scheduler/sendEmail.json.php enforces authentication. As an interim mitigation, block or restrict unauthenticated web access to the plugin/Scheduler/ directory at the web server or WAF level, and limit exposure of Live pages that hand out daily tokens. Review scheduler job data and associated email addresses for signs of enumeration or unauthorized email sends.