Vulnerability · Published Aug 22, 2026 · Assigned by VulnCheck

CVE-2026-59256WWBN AVideo Unbound Token Authorization Bypass via Gallery

High 7.5

In plain English

A high-severity information exposure in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 72.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken() creates tokens without binding to user identity or purpose, and plugin/Gallery/view/sections.php issues valid tokens to unauthenticated visitors. Attackers can retrieve a token from the Gallery endpoint and use it to bypass authorization checks in other subsystems like view/hls.php to access restricted video content.

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	0 – through 9c39d8c8b4c1f75540788d6b391740852ceb0732

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-wq57-wxcr-rx6v) vendor-advisory
VulnCheck Advisory: WWBN AVideo Unbound Token Authorization Bypass via Gallery third-party-advisory