HIGH 8.7 NVD
CVE-2026-59256
WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken() creates tokens without binding to user identity or purpose,
WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken() creates tokens without binding to user identity or purpose, and plugin/Gallery/view/sections.php issues valid tokens to unauthenticated visitors. Attackers can retrieve a token from the Gallery endpoint and use it to bypass authorization checks in other subsystems like view/hls.php to access restricted video content.
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-wq57-wxcr-rx6v
- https://www.vulncheck.com/advisories/wwbn-avideo-unbound-token-authorization-bypass-via-ga
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-08-22 via NVD.
vulnfeed aggregates 11022 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.