CVE-2026-90550— WWBN AVideo Missing Authorization via mediaSession.json.php
Quick assessment
Affected
WWBN AVideo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WWBN AVideo是WWBN组织开源的一个视频分享与内容管理平台。 WWBN AVideo c3edcc274c389816d434acadac07ee78eaf330c1及之前版本存在信息泄露漏洞，该漏洞源于PlayerSkins mediaSession.json.php端点未检查用户授权，可能导致未经身份验证的攻击者通过视频ID参数获取受密码保护的视频标题和所有者电子邮件地址。
Possible ATT&CK Techniques 1 AI
T1210 · Exploitation of Remote Services
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90550
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WWBN AVideo Missing Authorization via mediaSession.json.php
Source: CVE Program / CVE List V5
Vulnerability Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to check user authorization in the PlayerSkins mediaSession.json.php endpoint before returning video metadata. Unauthenticated attackers can request the endpoint with a video ID parameter to retrieve password-protected video titles and owner email addresses without authentication.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
WWBN AVideo 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WWBN AVideo是WWBN组织开源的一个视频分享与内容管理平台。 WWBN AVideo c3edcc274c389816d434acadac07ee78eaf330c1及之前版本存在信息泄露漏洞，该漏洞源于PlayerSkins mediaSession.json.php端点未检查用户授权，可能导致未经身份验证的攻击者通过视频ID参数获取受密码保护的视频标题和所有者电子邮件地址。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-90550
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90550
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-90550 (2)
Same Patch Batch · WWBN · 2026-09-12 · 17 CVEs total
| CVE-2026-90537 | 8.2 HIGH | WWBN AVideo Scheduler sendEmail Missing Authorization via Token |
| CVE-2026-90542 | 5.4 MEDIUM | WWBN AVideo Missing Authorization via remindMe.json.php |
| CVE-2026-90551 | 5.3 MEDIUM | WWBN AVideo Missing Authorization via video_from_program API |
| CVE-2026-90549 | 5.3 MEDIUM | WWBN AVideo Missing Authorization via videosAndroid.json.php Endpoint |
| CVE-2026-90548 | 5.3 MEDIUM | WWBN AVideo Missing Authorization in ImageGallery list.json.php |
| CVE-2026-90547 | 5.3 MEDIUM | WWBN AVideo Missing Authorization via getBookmarks.json.php |
| CVE-2026-90543 | 5.3 MEDIUM | WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php |
| CVE-2026-90541 | 5.3 MEDIUM | WWBN AVideo Unauthenticated Information Disclosure via menus.json.php |
| CVE-2026-90539 | 5.3 MEDIUM | WWBN AVideo Missing Authentication via menuItems.json.php |
| CVE-2026-90538 | 5.3 MEDIUM | WWBN AVideo Missing Authorization via playlistsFromUser.json.php |
| CVE-2026-90536 | 5.3 MEDIUM | WWBN AVideo Missing Authorization via adsInfo API Endpoint |
| CVE-2026-90552 | 4.3 MEDIUM | WWBN AVideo Missing Authorization via Playlists_schedules list.json.php |
| CVE-2026-90546 | 4.3 MEDIUM | WWBN AVideo Missing Authorization via like.json.php |
| CVE-2026-90545 | 4.3 MEDIUM | WWBN AVideo Missing Authorization via commentAddNew.json.php |
| CVE-2026-90544 | 4.3 MEDIUM | WWBN AVideo Missing Authorization via videoAddViewCount.json.php |
| CVE-2026-90540 | 4.3 MEDIUM | WWBN AVideo Missing Authorization via playListAddVideo.json.php |
IV. Related Vulnerabilities
Same product: AVideo
-
CVE-2026-105086
WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encode -
CVE-2026-105089
WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHP -
CVE-2026-100630
AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in tr -
CVE-2026-92915
WWBN AVideo userVerifyEmail.php Unauthenticated Access Contr -
CVE-2026-92914
AVideo LoginControl PGP Second Factor Authentication Bypass
Same vendor: WWBN
-
CVE-2026-105086
WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encode -
CVE-2026-105089
WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHP -
CVE-2026-100630
AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in tr -
CVE-2026-92915
WWBN AVideo userVerifyEmail.php Unauthenticated Access Contr -
CVE-2026-92914
AVideo LoginControl PGP Second Factor Authentication Bypass
Same weakness: CWE-200
-
CVE-2026-96626
Arcane: Container-registry credential exfiltration via URL r -
CVE-2026-69080
Apache Kylin: Broken Access Control in QuerySQLBlacklistCont -
CVE-2026-69077
Apache Kylin: JobController allows unauthorized cross-projec -
CVE-2026-69076
Apache Kylin: Unauthorized cross-project job discard -
CVE-2026-68572
Apache Kylin: Unauthorized SQL execution to Spark SQL env
V. Comments for CVE-2026-90550
No comments yet