WWBN AVideo videoViewsInfo Broken Access Control (Session Hijack & Credential Disclosure)

Technical Analysis

CVE-2026-86190 (CVSS 9.1) stems from insufficient authorization checks on the videoViewsInfo endpoint in WWBN AVideo, which returns sensitive user data—password hashes, password recovery tokens, and active session IDs—to any caller who supplies a valid hash parameter, without verifying the requester's identity or privilege level. Attackers can enumerate or brute-force hash values to harvest session identifiers and directly hijack authenticated sessions, including administrative accounts, bypassing the need to crack password hashes at all. This is a classic IDOR/broken-access-control pattern (CWE-284/CWE-639) that can be automated at scale against internet-facing AVideo instances to exfiltrate entire user databases. If an organization uses AVideo instances to host or distribute training data, internal demo videos, or documentation consumed by AI agent pipelines (e.g., RAG ingestion of video transcripts or metadata), a compromised admin session could allow attackers to inject malicious content into that pipeline or exfiltrate any API keys/credentials stored in AVideo's admin configuration, indirectly impacting downstream agent systems.

Affected Systems

WWBN AVideo platform, all deployments exposing videoViewsInfo endpoints without additional authentication controls; specific vulnerable version range not disclosed in source data, assume all versions prior to an unreleased patch until vendor advisory confirms fixed release

Indicators of Compromise

• Anomalous requests to /videoViewsInfo* or similar endpoint paths with arbitrary/enumerated hash parameter values
• High-volume or sequential hash-parameter requests from a single source IP
• Unexpected admin session reuse from new/unrecognized IP addresses following endpoint access
• Spikes in unauthenticated API calls to AVideo user-data endpoints

Remediation Steps

1. 1

   Apply vendor patch immediately

   Monitor WWBN AVideo's official channels for a security patch addressing CVE-2026-86190 and apply it as soon as released; treat this as emergency-priority given the critical severity.

2. 2

   Restrict endpoint access

   Until patched, place videoViewsInfo and related endpoints behind authentication at the reverse proxy/WAF layer, or disable the endpoint entirely if not business-critical.

3. 3

   Rotate credentials and invalidate sessions

   Force a global session invalidation and require password resets for all users, especially administrators, to eliminate any hijacked session identifiers currently in use.

4. 4

   Audit access logs

   Review web server and application logs for historical requests to the affected endpoint with anomalous hash parameters to identify potential prior exploitation and data exfiltration.

5. 5

   Deploy WAF rules

   Implement rate limiting and pattern-based blocking for suspicious hash-parameter enumeration attempts against AVideo endpoints.

6. 6

   Encrypt and re-hash sensitive fields

   Ensure password hashes use strong, salted algorithms (e.g., bcrypt/argon2) and rotate password recovery tokens platform-wide post-incident.