CVE-2026-90542
WWBN AVideo Missing Authorization via remindMe.json.php
CVSS Score
5.4
EPSS Score
0.1%
EPSS Percentile
4th
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate that logged-in users can access live schedules before creating reminders via remindMe.json.php. Authenticated attackers can create scheduler reminders for private live schedules they cannot view and learn the private schedule title from the generated email job.
| CWE | CWE-639 |
| Vendor | wwbn |
| Product | avideo |
| Published | Sep 12, 2026 |
| Last Updated | Sep 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for wwbn avideo
Be the first to know when new medium vulnerabilities affecting wwbn avideo are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
WWBN / AVideo
0 ≤ c3edcc274c389816d434acadac07ee78eaf330c1
References
Credits
🔍 santhreal