Vulnerability · Published Sep 12, 2026 · Assigned by VulnCheck
CVE-2026-90542WWBN AVideo Missing Authorization via remindMe.json.php
Medium 5.4
In plain English
A medium-severity authorization bypass via user-controlled key in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.2%top 84.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate that logged-in users can access live schedules before creating reminders via remindMe.json.php. Authenticated attackers can create scheduler reminders for private live schedules they cannot view and learn the private schedule title from the generated email job.
Affected products (as reported)
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
References
- GitHub Security Advisory (GHSA-qf26-4xp7-q5h9) vendor-advisory
- VulnCheck Advisory: WWBN AVideo Missing Authorization via remindMe.json.php third-party-advisory