Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate that logged-in users can access live schedules before creating reminders via remindMe.json.php. Authenticated attackers can create scheduler reminders for private live schedules they cannot view and learn the private schedule title from the generated email job.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-12T13:16:52.353Z",
  "pubdate": "2026-09-12T13:16:52.353Z",
  "executiveSummary": "WWBN AVideo contains an authorization bypass vulnerability within the remindMe.json.php script, affecting all versions up to commit c3edcc274c389816d434acadac07ee78eaf330c1.\nThe vulnerability stems from improper access control validation, allowing authenticated users to interact with live schedules without requisite permissions.\nAn attacker can exploit this flaw to programmatically create reminders for private live video schedules that are otherwise inaccessible to their user role.\nThe primary security implication is information disclosure; successful exploitation allows an attacker to exfiltrate private schedule titles, which are surfaced to the attacker via automated email jobs triggered by the application.\nThe attack requires a low-privilege authenticated session and does not necessitate administrative rights, effectively bypassing security boundaries intended to protect private live content metadata.\nThe risk is categorized as an authorization failure that violates the principle of least privilege, potentially exposing sensitive scheduling information to unauthorized parties.",
  "technicalDetails": "The vulnerability resides in the remindMe.json.php file, which serves as an endpoint for users to schedule notifications for upcoming live streams. The root cause of this security flaw is the failure of the server-side logic to perform an access control check against the target resource identifier before processing the reminder request.\nIn the vulnerable implementation, the application receives a request containing a schedule ID. While the system authenticates the user, it fails to verify whether the authenticated session possesses the authorized permissions to view the specific live schedule associated with that ID. Consequently, the application treats any authenticated user as authorized to interact with any schedule object within the database.\nThe exploitation flow is as follows: 1) The attacker authenticates to the AVideo platform with a standard user account. 2) The attacker identifies or brute-forces valid schedule IDs associated with private live streams. 3) The attacker submits a specially crafted request to remindMe.json.php, targeting a private schedule ID. 4) The server processes the request without validating authorization, successfully creating a reminder entry for the private resource. 5) Upon the creation of this reminder, the AVideo backend triggers an automated email job. 6) The attacker receives the email, which contains the title of the private live schedule, thereby leaking sensitive information that should remain hidden from unauthorized users.\nThis vulnerability is particularly impactful because the disclosure occurs through a legitimate system function (the notification engine). By manipulating the input parameters of the PHP script, the attacker leverages the application's own functionality to exfiltrate metadata. Since the notification job retrieves the schedule title from the database to populate the email template, the backend effectively performs the unauthorized data lookup on behalf of the attacker.\nThis issue represents a failure in the application's authorization layer, specifically the omission of per-object access control lists (ACLs) or permission verification logic within the live scheduling module. As the software is web-based, the exposure is accessible over any network where the AVideo instance is deployed, and because it relies on authenticated session cookies, it is trivial to automate.\nPost-exploitation, the attacker gains visibility into the private broadcast schedule of the platform. This metadata could be used to facilitate further attacks, map platform content, or identify high-value private streams that may be targets for further unauthorized access attempts."
}