Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate that logged-in users can access live schedules before creating reminders via remindMe.json.php. Authenticated attackers can create scheduler reminders for private live schedules they cannot view and learn the private schedule title from the generated email job.
Published: 2026-09-12
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Exposure of Private Live Schedule Titles
Action: Apply Patch
AI Analysis

Impact

WWBN AVideo has a missing authorization check in the remindMe.json.php endpoint. Authenticated users that otherwise cannot access the content can still create scheduler reminders. The generated email job contains the schedule title, allowing the attacker to discover the title of a private schedule. This flaw is a classic missing authorization weakness (CWE-639).

Affected Systems

The vulnerability exists in WWBN AVideo releases that include commit c3edcc274c389816d434acadac07ee Any release built from that commit onward is potentially vulnerable until the authorization check is restored.

Risk and Exploitability

The CVSS score is 5.3, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is less than 1%. Once authenticated, exploitation is trivial: an attacker can freely create reminders for private schedules and learn the schedule title from the email job.

Generated by OpenCVE AI on September 15, 2026 at 02:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade WWBN AVideo to the latest release that includes the missing authorization check for remindMe.json.php
  • If an upgrade is not possible, restrict access to remindMe.json.php by configuring the web server to allow only privileged users
  • Patch the code locally to add an authorization check before creating reminders, ensuring the user has permission to view the target live schedule
  • Monitor application logs for unauthorized reminder creation attempts and review email job outputs

Generated by OpenCVE AI on September 15, 2026 at 02:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 12 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
Description WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate that logged-in users can access live schedules before creating reminders via remindMe.json.php. Authenticated attackers can create scheduler reminders for private live schedules they cannot view and learn the private schedule title from the generated email job.
Title WWBN AVideo Missing Authorization via remindMe.json.php
First Time appeared Wwbn
Wwbn avideo
Weaknesses CWE-639
CPEs cpe:2.3:a:wwbn:avideo:-:*:*:*:*:*:*:*
Vendors & Products Wwbn
Wwbn avideo
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Wwbn Avideo
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-15T17:02:09.962Z

Reserved: 2026-09-12T11:12:50.792Z

Link: CVE-2026-90542

cve-icon Vulnrichment

Updated: 2026-09-15T17:02:03.543Z

cve-icon NVD

Status : Deferred

Published: 2026-09-12T13:16:52.353

Modified: 2026-09-15T18:19:36.713

Link: CVE-2026-90542

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T03:00:21Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key