Vulnerability · Published Sep 12, 2026 · Assigned by VulnCheck
CVE-2026-90544WWBN AVideo Missing Authorization via videoAddViewCount.json.php
Medium 4.3
In plain English
A medium-severity missing authorization in AVideo from WWBN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 81.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the videoAddViewCount.json.php endpoint before updating view statistics. Authenticated attackers can increment view counts and watch-time on videos they cannot access by submitting requests with arbitrary video IDs.
Affected products (as reported)
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
References
- GitHub Security Advisory (GHSA-2fgr-549m-8g5w) vendor-advisory
- VulnCheck Advisory: WWBN AVideo Missing Authorization via videoAddViewCount.json.php third-party-advisory