Missing Authorization in WWBN AVideo Exposes Scheduler Email Jobs

Executive Summary

A high-severity missing authorization vulnerability (CVE-2026-90537) has been disclosed in WWBN AVideo, a popular self-hosted video and live-streaming platform. The flaw sits in plugin/Scheduler/sendEmail.json.php, which authorizes requests using a site-wide "daily token" instead of a per-user or session-based check. That token is trivially obtainable — it's exposed on AVideo's public Live pages — so any unauthenticated visitor who grabs one can call the Scheduler API directly.

CVSS Score: 8.2 (CVSS 3.1) / 8.8 (CVSS 4.0)

A proof-of-concept is already circulating, and the issue has been assigned GitHub Security Advisory GHSA-qq59-3jwp-hgj9.

Vulnerability Overview

Affected Versions

Attack Vector

1. Attacker visits any public Live page on the target AVideo instance
2. Attacker extracts the site-wide "daily token" embedded in the page
3. Attacker replays that token against plugin/Scheduler/sendEmail.json.php,
   which performs no per-user authentication check
4. The endpoint returns a full list of scheduled email jobs, including
   private live-stream titles and recipient email addresses
5. Attacker can also trigger any enumerated job to send immediately

Impact of Successful Exploitation

This maps to MITRE ATT&CK T1590 (Gather Victim Network Information) for the enumeration step, since the token-reuse design flaw skips authentication entirely rather than bypassing it.

Related issue in the same codebase: CVE-2026-90543 is a separate missing-authentication bug in plugin/Live/socketMessageLiveOwner.json.php, which performs no User::isLogged() check at all. If you run AVideo, patch for both — they point at the same underlying pattern of endpoints trusting client-supplied identifiers instead of verifying the session.

Immediate Remediation

Step 1: Check Your Build

Compare your deployed commit against c3edcc274c389816d434acadac07ee78eaf330c1 and the vendor's GitHub repository to determine if you're on an affected build.

Step 2: Reduce Exposure

1. Update AVideo to the latest release once the vendor confirms a fix for GHSA-qq59-3jwp-hgj9
2. Restrict access to Live pages (auth-wall or IP allow-list) as a stopgap, since the daily token is sourced from there
3. Front the Scheduler API with a reverse-proxy authentication layer until the endpoint itself enforces per-user checks

Step 3: Monitor for Abuse

# Review access logs for repeated calls to:
plugin/Scheduler/sendEmail.json.php
 
# Flag any requests using a token value not tied to a legitimate,
# currently logged-in session

Post-Remediation Steps

1. Apply the vendor patch as soon as it's published and confirm the endpoint now validates the requesting session, not just a shared token
2. Rotate any daily tokens and review Scheduler job data for signs it was already enumerated
3. Audit the wider Scheduler and Live plugin directories for the same site-wide-token pattern, given the related CVE-2026-90543 finding
4. Notify recipients if scheduled emails were sent outside expected windows during the exposure period

References

• VulDB — CVE-2026-90537 in AVideo
• OffSeq Threat Radar — CVE-2026-90537 Missing Authorization in WWBN AVideo
• Shenlong CVE Platform — Scheduler sendEmail Missing Authorization Intel
• NIST NVD — CVE-2026-90537

Related Reading

• CSRF-to-RCE File Upload Flaw in Gpx2Graphics Plugin
• DS Ad Rotator Plugin Flaw Allows Unauthenticated RCE on WordPress