Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate that logged-in users can access live schedules before creating reminders via remindMe.json.php. Authenticated attackers can create scheduler reminders for private live schedules they cannot view and learn the private schedule title from the generated email job.
Published: 2026-09-12
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Exposure of Private Live Schedule Titles
Action: Apply Patch
AI Analysis

Impact

WWBN AVideo has a missing authorization check in the remindMe.json.php endpoint. Authenticated that they otherwise cannot access. The generated email job contains the schedule title, allowing the attacker to discover the title of a private schedule. This flaw is a classic missing authorization weakness (CWE-639).

Affected Systems

The vulnerability exists in WWBN AVideo releases that include commit c3edcc274c389816d434acadac07ee78eaf330c. Any release built from that commit onward is potentially vulnerable until the authorization check is restored.

Risk and Exploitability

The CVSS score is 5.3, and the vulnerability is not listed in the CISA KEV catalog. EPSS data is not available. Once authenticated, exploitation is trivial: an attacker can freely create reminders for private schedules and learn the schedule title from the email job. The risk is elevated for compromised or default accounts.

Generated by OpenCVE AI on September 13, 2026 at 14:01 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade WWBN AVideo to the latest release that includes the missing authorization check for remindMe.json.php
  • If an upgrade is not possible, restrict access to remindMe.json.php by configuring the web server to allow only privileged users
  • Patch the code locally to add an authorization check before creating reminders, ensuring the user has permission to view the target live schedule
  • Monitor application logs for unauthorized reminder creation attempts and review email job outputs

Generated by OpenCVE AI on September 13, 2026 at 14:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 12 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
Description WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate that logged-in users can access live schedules before creating reminders via remindMe.json.php. Authenticated attackers can create scheduler reminders for private live schedules they cannot view and learn the private schedule title from the generated email job.
Title WWBN AVideo Missing Authorization via remindMe.json.php
First Time appeared Wwbn
Wwbn avideo
Weaknesses CWE-639
CPEs cpe:2.3:a:wwbn:avideo:-:*:*:*:*:*:*:*
Vendors & Products Wwbn
Wwbn avideo
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Wwbn Avideo
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-12T12:08:49.065Z

Reserved: 2026-09-12T11:12:50.792Z

Link: CVE-2026-90542

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-12T13:16:52.353

Modified: 2026-09-12T13:16:52.353

Link: CVE-2026-90542

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-13T14:15:06Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key