VulnerabilityReceived

CVE-2026-90544

Authenticated attackers can increment view counts and watch-time on videos they cannot access by submitting requests with arbitrary video IDs.

MEDIUM 5.3EPSS —

Does this matter?

Lower severity and no EPSS score yet. Track it; it rarely justifies an emergency change on its own.

Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the videoAddViewCount.json.php endpoint before updating view statistics. Authenticated attackers can increment view counts and watch-time on videos they cannot access by submitting requests with arbitrary video IDs.

CVSS 4.0: 5.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: No score yet
CISA KEV: Not listed
Weakness: CWE-862
Source: disclosure@vulncheck.com

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-2fgr-549m-8g5w
https://www.vulncheck.com/advisories/wwbn-avideo-missing-authorization-via-videoaddviewcount-json-php

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.