CRITICAL 9.3 NVD
CVE-2026-86190
WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery to
WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session identifier to hijack viewer sessions, including administrator accounts, and obtain sensitive personal data for all video viewers.
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-82q2-88mq-p44q
- https://www.vulncheck.com/advisories/wwbn-avideo-broken-access-control-via-videoviewsinfo-
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-09-05 via NVD.
Risk Timeline
CVE Disclosed2026-09-05 · -1 days ago
Remediation Resources
vulnfeed aggregates 10223 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.