CVE-2026-90551 WWBN CVE debrief

Who should care

Defenders and administrators of AVideo installations should assess exposure and verify authentication and authorization checks to prevent potential enumeration of private playlist names and owner information, as well as unauthenticated access to sensitive content. They should also review and update authentication and authorization checks for the video_from_program API endpoint, verify and restrict access to private playlist contents, and monitor for signs

Why it matters

AVideo's failure to validate playlist ownership in the video_from_program API endpoint allows unauthenticated access to private playlist contents. Defenders and administrators of AVideo installations should assess exposure and verify authentication and authorization checks to prevent potential enumeration of private playlist names and owner information, as well as unauthenticated access to sensitive content. The impact of this vulnerability requires verification from official sources, and the effectiveness of mitigations is still unknown.

• Potential enumeration of private playlist names and owner information
• Unauthenticated access to private playlist contents, including password-protected content

Technical summary

The video_from_program API endpoint in AVideo fails to validate playlist ownership, allowing unauthenticated access to private playlist contents. This vulnerability may allow attackers to enumerate private playlist names, owner information, and video titles, including password-protected content. The impact of this vulnerability requires verification from official sources, and the effectiveness of mitigations is still unknown. Defenders should review compensating controls for exposed systems while remediation is scheduled and verified.

Defensive priority

Medium priority for authentication and authorization checks

Recommended defensive actions

• Review and update authentication and authorization checks for the video_from_program API endpoint
• Verify and restrict access to private playlist contents
• Monitor for potential enumeration of private playlist names and owner information
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the vendor and affected versions are not clearly identified. To verify the vulnerability, defenders should review the official CVE Program record and NIST NVD detail page for source-provided CVE metadata and source-specific vulnerability assessment. The evidence is limited, and further verification is required to confirm the affected scope, severity, and vendor guidance. Defenders should also check relevant monitoring, detection, and logs for exposed assets. A

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.