Authorization Bypass Vulnerability in WWBN AVideo (CVE-2026-59256)

Executive Summary

A vulnerability in WWBN AVideo, tracked as CVE-2026-59256, allows attackers to bypass authorization checks by retrieving a token from the Gallery endpoint. This vulnerability has a CVSS score of 7.5 and is classified as HIGH severity. Users of AVideo should update to a fixed version to mitigate this risk.

Technical Analysis

The vulnerability is an authorization bypass issue in WWBN AVideo through commit 9c39d8c8. The getToken() function creates tokens without binding to user identity or purpose. Additionally, plugin/Gallery/view/sections.php issues valid tokens to unauthenticated visitors. This allows attackers to retrieve a token from the Gallery endpoint and use it to bypass authorization checks in other subsystems, such as view/hls.php, to access restricted video content.

How It Gets Exploited

An unauthenticated remote attacker can exploit this vulnerability by sending a request to the Gallery endpoint to retrieve a valid token. With this token, the attacker can bypass authorization checks in other subsystems, such as accessing restricted video content through view/hls.php. The attack involves the following steps: - The attacker sends a request to the Gallery endpoint. - The attacker receives a valid token in response. - The attacker uses the token to access restricted video content via view/hls.php.

Impact Assessment

The vulnerability affects WWBN AVideo versions up to and including commit 9c39d8c8. An attacker can achieve unauthorized access to restricted video content with a CVSS score of 7.5, indicating high severity. The vulnerability allows for high impact on confidentiality, with no impact on integrity or availability.

Recommended Actions

To mitigate this vulnerability, users of WWBN AVideo should update to a version beyond commit 9c39d8c8. Specifically, update to a version that correctly binds tokens to user identity and purpose, and ensures that tokens issued by plugin/Gallery/view/sections.php are properly validated. Additionally, implement proper authorization checks for all endpoints that require authentication.

Sources

- National Vulnerability Database (NVD) - https://nvd.nist.gov/vuln/detail/CVE-2026-59256 - https://github.com/WWBN/AVideo/security/advisories/GHSA-wq57-wxcr-rx6v - https://www.vulncheck.com/advisories/wwbn-avideo-unbound-token-authorization-bypass-via-gallery