Vulnerability · Published Sep 5, 2026 · Assigned by VulnCheck

CVE-2026-86190WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter

Critical 9.1

In plain English

A critical-severity information exposure in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.4%top 61.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session identifier to hijack viewer sessions, including administrator accounts, and obtain sensitive personal data for all video viewers.

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	0 – through 29.0

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-82q2-88mq-p44q) vendor-advisory
VulnCheck Advisory: WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter third-party-advisory