WWBN AVideo: Missing authorization in tags API exposes restricted video data
Summary
WWBN AVideo through 29.7.1 has a missing authorization flaw in the get_api_tags() function of the API plugin. An attacker with a registered user account can subscribe to a tag and query the tags API to retrieve filenames, titles and stored video passwords of unlisted, group-restricted and password-protected videos. This allows unauthorized viewing of private content, with no impact on integrity or availability.
Affected
- WWBN AVideo 0 through 29.7.1 (per CVE record by VulnCheck)
- VulDB also lists 29.7.0 and 29.7.1 as affected
Fixed in
Unknown. The CVE record references commit a8d1e0e484d655556422841d08b2b0fb64332721 as the patch, but the fixed release has not been confirmed.
Workaround
Unknown. No vendor-documented workaround was found.
- Limit who can create accounts, since the attacker must be a registered user.
- Review which videos rely on password or group restrictions and change their passwords, because stored passwords may be exposed.
Exploitation
- No known exploitation in the wild; not listed in CISA KEV.
- No public proof-of-concept found. VulDB states technical details are known but no exploit is available.
Our recommendation
- Check whether an AVideo instance is internet-facing with open registration and holds private or paid content. Prioritize these systems.
- Update to the fixed release as soon as the vendor confirms it via GHSA-3w98-8958-84rh and the referenced commit.
- Until patched, restrict account creation and rotate passwords of protected videos.
- Monitor logs for unusual tags API requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-126545 www.cve.org
- GitHub Security Advisory GHSA-3w98-8958-84rh github.com
- AVideo commit a8d1e0e (referenced patch) github.com
- VulnCheck advisory: missing authorization via get_api_tags www.vulncheck.com
- AVideo API.php at v29.7.1 github.com
- AVideo TagsHasVideos.php at v29.7.1 github.com
- VulDB entry 435559 vuldb.com
- TheHackerWire CVE-2026-126545 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:12.
Original description (NVD)
WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get_api_tags() in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored video_password values of unlisted, group-restricted and password-protected videos, enabling unauthorized viewing.
NVD references (6)
- https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/API/API.php#L958-L976
- https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/VideoTags/Objects/TagsHasVideos.php#L172-L180
- https://github.com/WWBN/AVideo/commit/a8d1e0e484d655556422841d08b2b0fb64332721
- https://github.com/WWBN/AVideo/security/advisories/GHSA-3w98-8958-84rh
- https://www.vulncheck.com/advisories/wwbn-avideo-through-29.7.1-missing-authorization-via-get-api-tags-api
- https://github.com/WWBN/AVideo/security/advisories/GHSA-3w98-8958-84rh
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.