CVE-2026-90546 WWBN CVE debrief

Who should care

Defenders responsible for video platforms and access control systems should assess exposure and verify video access controls. This includes reviewing official advisories and CVE records to validate affected scope, severity, and vendor guidance. Additionally, defenders should plan for vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

Defenders should care about CVE-2026-90546 because it allows logged-in users to bypass access controls on AVideo platforms, potentially leading to unauthorized access to sensitive content.

• Potential for unauthorized access to sensitive videos
• Bypassing of access controls through like requests

Technical summary

The like.json.php endpoint in AVideo fails to validate video access permissions, allowing logged-in users to record likes on password-protected and group-restricted videos. This vulnerability can be exploited by attackers to increment like counters and bypass access controls. The issue highlights the need for proper access control validation in video platforms to prevent unauthorized access to sensitive content. Defenders should prioritize verifying video access controls and monitoring like requests to mitigate this vulnerability.

Defensive priority

Defenders should prioritize verifying video access controls and monitoring like requests.

Recommended defensive actions

• Verify video access controls are properly implemented
• Monitor like requests for suspicious activity
• Restrict access to sensitive videos
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the corpus does not establish versions, exploitation, impact, or remediation. Further verification is needed to determine affected scope, severity, and vendor guidance. Defenders should review official advisories and CVE records to validate exposure and plan for vendor-supported updates or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.