CVE-2026-86190 — WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter
WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live se…
Published: 2026-09-05 · CVSS: 9.3 · CVSS 4.0
WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session identifier to hijack viewer sessions, including administrator accounts, and obtain sensitive personal data for all video viewers.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7