Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-90536: WWBN AVideo reveals video owner IDs via adsInfo API
CVE-2026-90536 · published 1 month ago
Summary
The AVideo software lets anyone request the adsInfo service and see the ID of the video’s owner and links to personalized ads, even if the video is password‑protected. This means an outsider could learn who posted a video and view internal ad details without logging in. Apply the latest update from the vendor or disable the adsInfo endpoint until it is patched.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| wwbn | avideo | <= c3edcc274c389816d434acadac07ee78eaf330c1 |
Original advisory text
WWBN AVideo Missing Authorization via adsInfo API Endpoint
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to authorize access to the adsInfo API endpoint, allowing unauthenticated attackers to retrieve password-protected video owner identifiers. Attackers can call the adsInfo API with a videos_id parameter to obtain the owner's user ID and personalized ad creative URLs without authentication or permission checks.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90536... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-90536 Vendor Advisory
- https://github.com/WWBN/AVideo/security/advisories/GHSA-989c-frwf-gprj Vendor Advisory
- https://www.vulncheck.com/advisories/wwbn-avideo-missing-authorization-via-adsin... Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
7.8
High
Type
CWE-200Information Exposure
Timeline
Published12 Sep 2026
Updated4 Nov 2026
First seen12 Sep 2026
Track software like this
Free during beta