CVE-2026-86190: Wwbn Avideo

Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days.

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session identifier to hijack viewer sessions, including administrator accounts, and obtain sensitive personal data for all video viewers.

Affected products

• Wwbn Avideo: up to and including 29.0

Published 2026-09-05. Last modified 2026-09-08.