CVE-2026-126545— WWBN AVideo through 29.7.1 Missing Authorization via get_api_tags API

Quick assessment

Affected

WWBN AVideo

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WWBN AVideo 29.7.1 及以下版本存在一个授权缺失漏洞，位于插件文件中的函数。该漏洞允许已注册用户通过查询标签（tags）API 访问受限的视频数据。攻击者可订阅某个标签，并调用接口，从而获取未公开视频、组限制视频以及密码保护视频的文件名、标题和存储的值，进而实现未经授权的观看。

CVSS 4.3 · Medium Updated Nov 11, 2026

Possible ATT&CK Techniques 2 AI

T1530 · Data from Cloud Storage T1068 · Exploitation for Privilege Escalation

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

WWBN AVideo through 29.7.1 Missing Authorization via get_api_tags API

Source: CVE Program / CVE List V5

Vulnerability Description

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get_api_tags() in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored video_password values of unlisted, group-restricted and password-protected videos, enabling unauthorized viewing.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
WWBN	AVideo	0 ~ 29.7.1	-

II. Public POCs for CVE-2026-126545

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-126545

请登录查看更多情报信息。

Other References for CVE-2026-126545 (5)

https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/API/API.php#L958-L976 technical-description
https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/VideoTags/Objects/TagsHasVideos.php#L172-L180 technical-description
https://github.com/WWBN/AVideo/commit/a8d1e0e484d655556422841d08b2b0fb64332721 patch
https://github.com/WWBN/AVideo/security/advisories/GHSA-3w98-8958-84rh vendor-advisory
https://www.vulncheck.com/advisories/wwbn-avideo-through-29.7.1-missing-authorization-via-get-api-tags-api third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-126545

Same Patch Batch · WWBN · 2026-11-11 · 5 CVEs total

CVE-2026-126542	9.8 CRITICAL	WWBN AVideo 6.5 through 29.7.1 Authentication Bypass via Hybridauth Social Login
CVE-2026-126541	8.1 HIGH	WWBN AVideo through 29.7.1 Missing Authorization via Live Restream Endpoints
CVE-2026-126543	7.5 HIGH	WWBN AVideo through 29.7.1 Wallet Credit Manipulation via PayPalYPT ipnV2.php
CVE-2026-126544	4.3 MEDIUM	WWBN AVideo 6.5 through 29.7.1 Email Verification Bypass via User::verifyCode()

IV. Related Vulnerabilities

Same product: AVideo

Same vendor: WWBN

Same weakness: CWE-862