Description

WWBN AVideo through commit 9c39d8c8b4c1f75540788d6b391740852ceb0732 contains an authorization bypass vulnerability in the Users_affiliations add.json.php endpoint that allows authenticated users to forge two-party consent records by supplying the counterparty's agreement timestamp. Attackers can create a forged affiliation with status='a' and then reassign video ownership to arbitrary users through the videoAddNew.json.php endpoint, which trusts the forged affiliation as an authorization term.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-22T13:16:38.540Z",
  "pubdate": "2026-08-22T13:16:38.540Z",
  "executiveSummary": "WWBN AVideo through commit 9c39d8c8b4c1f75540788d6b391740852ceb0732 suffers from an authorization bypass vulnerability affecting the Users_affiliations add.json.php endpoint. This security flaw enables authenticated users to forge two-party consent records by supplying an arbitrary counterparty agreement timestamp. By leveraging this mechanism, attackers can successfully establish fraudulent user affiliations with an active status of 'a'.\nThe broader impact of this vulnerability is severe, as the forged affiliations are improperly trusted as valid authorization terms by subsequent application logic. Specifically, attackers can abuse the videoAddNew.json.php endpoint to reassign video ownership to arbitrary users within the system. The risk implications include unauthorized resource manipulation, potential data compromise, and integrity violations of media ownership controls.\nExploitation of this vulnerability requires authenticated access to the platform and the ability to interact with the vulnerable PHP endpoints. Attackers do not require elevated administrative privileges to forge the consent records, making standard authenticated user accounts sufficient to trigger the flaw and perform subsequent unauthorized video ownership reassignments.",
  "technicalDetails": "The root cause of the vulnerability stems from improper input validation and deficient authorization checks within the affiliation management and video ownership assignment subsystems of WWBN AVideo. Specifically, the application fails to cryptographically verify or server-side validate the authenticity of two-party consent records submitted during the affiliation process.\nThe vulnerable components include the Users_affiliations add.json.php endpoint, which processes affiliation requests, and the videoAddNew.json.php endpoint, which handles video creation and ownership assignments. The affected software versions include WWBN AVideo through commit 9c39d8c8b4c1f75540788d6b391740852ceb0732.\nAuthentication is required to exploit this vulnerability, as the attacker must interact with the application endpoints using a standard authenticated user session. However, no specialized administrative privileges are necessary.\nThe attack flow proceeds in a multi-step sequence. First, an authenticated attacker sends a crafted HTTP request to the Users_affiliations add.json.php endpoint. By supplying a manipulated counterparty agreement timestamp, the attacker bypasses the intended two-party consent validation mechanism. This action forces the creation of a fraudulent affiliation record possessing a status value of 'a' (active), falsely indicating mutual agreement between the parties.\nSecond, the attacker leverages this newly minted, fraudulent affiliation by interacting with the videoAddNew.json.php endpoint. The application logic exhibits insecure design by trusting the forged affiliation record as a legitimate authorization term without performing secondary verification against the purported counterparty.\nConsequently, the videoAddNew.json.php endpoint honors the request and permits the attacker to reassign video ownership to arbitrary users. The post-exploitation impact allows malicious actors to hijack media assets, alter resource attribution across the platform, and potentially gain unauthorized control over sensitive video content belonging to other users or administrators."
}