Vulnerability · Published Sep 3, 2026 · Assigned by VulnCheck

CVE-2026-85156WWBN AVideo Broken Access Control via Channel Page

Medium 5.3

In plain English

A medium-severity information exposure in AVideo from WWBN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 72.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through hardcoded visibility flags and an undefined property. Attackers can access the channel endpoint to retrieve sensitive video content that should be hidden, including full URLs to unlisted videos and thumbnails of member-only content, regardless of the operator's hidePrivateVideos setting.

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	0 – through 29.0

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-h779-9wfc-c6m8) vendor-advisory
VulnCheck Advisory: WWBN AVideo Broken Access Control via Channel Page third-party-advisory