CVE-2026-90547— WWBN AVideo Missing Authorization via getBookmarks.json.php
Quick assessment
Affected
WWBN AVideo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WWBN AVideo是WWBN组织开源的一个视频分享与内容管理平台。 WWBN AVideo c3edcc274c389816d434acadac07ee78eaf330c1及之前版本存在授权问题漏洞，该漏洞源于Bookmark插件getBookmarks.json.php端点未验证用户权限，可能导致未经验证的攻击者通过视频ID参数，在无需密码验证的情况下读取受密码保护视频的章节名称等敏感元数据。
Possible ATT&CK Techniques 1 AI
T1213 · Data from Information Repositories
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90547
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WWBN AVideo Missing Authorization via getBookmarks.json.php
Source: CVE Program / CVE List V5
Vulnerability Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the Bookmark plugin getBookmarks.json.php endpoint, allowing unauthenticated attackers to read chapter names from password-protected videos. Attackers can query the endpoint with a video ID parameter to retrieve sensitive chapter metadata without authentication or password verification.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
WWBN AVideo 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WWBN AVideo是WWBN组织开源的一个视频分享与内容管理平台。 WWBN AVideo c3edcc274c389816d434acadac07ee78eaf330c1及之前版本存在授权问题漏洞，该漏洞源于Bookmark插件getBookmarks.json.php端点未验证用户权限，可能导致未经验证的攻击者通过视频ID参数，在无需密码验证的情况下读取受密码保护视频的章节名称等敏感元数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-90547
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90547
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-90547 (2)
Same Patch Batch · WWBN · 2026-09-12 · 17 CVEs total
| CVE-2026-90537 | 8.2 HIGH | WWBN AVideo Scheduler sendEmail Missing Authorization via Token |
| CVE-2026-90542 | 5.4 MEDIUM | WWBN AVideo Missing Authorization via remindMe.json.php |
| CVE-2026-90550 | 5.3 MEDIUM | WWBN AVideo Missing Authorization via mediaSession.json.php |
| CVE-2026-90551 | 5.3 MEDIUM | WWBN AVideo Missing Authorization via video_from_program API |
| CVE-2026-90549 | 5.3 MEDIUM | WWBN AVideo Missing Authorization via videosAndroid.json.php Endpoint |
| CVE-2026-90548 | 5.3 MEDIUM | WWBN AVideo Missing Authorization in ImageGallery list.json.php |
| CVE-2026-90543 | 5.3 MEDIUM | WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php |
| CVE-2026-90541 | 5.3 MEDIUM | WWBN AVideo Unauthenticated Information Disclosure via menus.json.php |
| CVE-2026-90539 | 5.3 MEDIUM | WWBN AVideo Missing Authentication via menuItems.json.php |
| CVE-2026-90538 | 5.3 MEDIUM | WWBN AVideo Missing Authorization via playlistsFromUser.json.php |
| CVE-2026-90536 | 5.3 MEDIUM | WWBN AVideo Missing Authorization via adsInfo API Endpoint |
| CVE-2026-90552 | 4.3 MEDIUM | WWBN AVideo Missing Authorization via Playlists_schedules list.json.php |
| CVE-2026-90546 | 4.3 MEDIUM | WWBN AVideo Missing Authorization via like.json.php |
| CVE-2026-90545 | 4.3 MEDIUM | WWBN AVideo Missing Authorization via commentAddNew.json.php |
| CVE-2026-90544 | 4.3 MEDIUM | WWBN AVideo Missing Authorization via videoAddViewCount.json.php |
| CVE-2026-90540 | 4.3 MEDIUM | WWBN AVideo Missing Authorization via playListAddVideo.json.php |
IV. Related Vulnerabilities
Same product: AVideo
-
CVE-2026-105086
WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encode -
CVE-2026-105089
WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHP -
CVE-2026-100630
AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in tr -
CVE-2026-92915
WWBN AVideo userVerifyEmail.php Unauthenticated Access Contr -
CVE-2026-92914
AVideo LoginControl PGP Second Factor Authentication Bypass
Same vendor: WWBN
-
CVE-2026-105086
WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encode -
CVE-2026-105089
WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHP -
CVE-2026-100630
AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in tr -
CVE-2026-92915
WWBN AVideo userVerifyEmail.php Unauthenticated Access Contr -
CVE-2026-92914
AVideo LoginControl PGP Second Factor Authentication Bypass
Same weakness: CWE-862
-
CVE-2026-64862
Frappe HR: Missing Authorization on PWA API Endpoints enable -
CVE-2026-108373
ERPNext: Unauthorised access to financial data due to missin -
CVE-2026-108374
ERPNext: Unauthorised status modification due to missing val -
CVE-2026-111723
LingGuo-Drama through commit 8a6924a Broken Access Control v -
CVE-2026-111683
Allegro Ralph through 20260902.1 Missing Authorization in Da
V. Comments for CVE-2026-90547
No comments yet