Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token. Attackers can enumerate scheduler jobs, read private live titles and email addresses, and trigger email sending by supplying any valid daily token obtained from Live pages.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-12T13:16:51.667Z",
  "pubdate": "2026-09-12T13:16:51.667Z",
  "executiveSummary": "A missing authorization vulnerability exists within the WWBN AVideo platform, specifically affecting the plugin/Scheduler/sendEmail.json.php component.\nThis security flaw allows unauthenticated remote attackers to bypass access controls by leveraging a site-wide daily token typically used for Live page operations.\nThe vulnerability exposes sensitive system information, including scheduler job configurations, private live stream titles, and registered user email addresses.\nBeyond information disclosure, the flaw permits unauthorized interaction with the scheduler, enabling attackers to trigger automated email-sending processes.\nThe root cause is a failure to properly authenticate requests to the endpoint, relying instead on a predictable or discoverable daily token that is not adequately restricted to the intended context.\nThis vulnerability poses a significant risk to data privacy and system integrity, as attackers can enumerate internal jobs and abuse notification systems. No specialized privileges are required beyond the acquisition of a valid daily token, which is readily accessible via public-facing pages, facilitating low-complexity exploitation.",
  "technicalDetails": "The vulnerability resides in plugin/Scheduler/sendEmail.json.php, which serves as an interface for managing and executing email-based scheduler tasks within the AVideo platform. The implementation fails to enforce robust session-based or role-based access control, instead checking for a 'daily token' which is ostensibly intended to act as a pseudo-authentication mechanism.\nThe attack vector involves the acquisition of this daily token, which is exposed on public-facing Live pages. Once an attacker obtains this token, they can present it in requests to the vulnerable endpoint to bypass authorization checks. Because this token is site-wide and functionally static for the duration of the day, it fails to provide the cryptographically secure per-user or per-session authentication necessary for sensitive administrative endpoints.\nThe attack flow proceeds as follows: First, the attacker navigates to publicly accessible Live pages on the target AVideo instance to harvest a valid daily token. Second, the attacker crafts an HTTP request targeting plugin/Scheduler/sendEmail.json.php, injecting the harvested token into the request parameters. Third, due to the missing authorization check, the server processes the request as legitimate, granting the attacker access to the scheduler's data structures.\nPost-exploitation, the attacker can perform comprehensive enumeration of scheduler jobs, revealing the internal task registry. Furthermore, the attacker gains access to metadata associated with these jobs, such as private live title information and the list of target email addresses stored within the scheduler's configuration. The vulnerability also exposes an escalation path where the attacker can force the application to execute pending email jobs, effectively enabling the abuse of the platform's internal notification system for unauthorized spam or reconnaissance activities.\nThis issue affects WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1. The absence of strict input validation and session context verification at the entry point of the script confirms that the security logic is insufficient to protect sensitive administrative actions from unauthenticated, remote actors."
}