CVE-2026-86190Disclosure

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session identifier to hijack viewer sessions, including administrator accounts, and obtain sensitive personal data for all video viewers.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-200

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-09-05); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

General

133.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-05	2	Disclosure1General1
2026-09-06	1	Disclosure1

Full discourse3 posts

ThreatAft@ThreatAft46d
Disclosure
🔐🚨 WWBN AVideo — TWO UNAUTHENTICATED CVEs CVE-2026-86189 (9.8): Path traversal → arbitrary file write → RCE CVE-2026-86190 (9.1): Full user records exposed (password hashes, tokens) → https://threataft.com/articles/wwbn-avideo-two-unauthenticated-cves #cybersecurity #infosec #WWBN #AVideo #RCE #CVSS9 #ThreatIntel
Post summary
An article announces two unauthenticated CVEs in WWBN AVideo, describing a path traversal that leads to RCE and full user record disclosure with high CVSS scores.
0000056
42 followersView on X
SystemTek - Technology news website@SystemTek_UK46d
General
Critical AVideo Vulnerability Could Expose Password Hashes and Session Tokens (CVE-2026-86190) https://www.systemtek.co.uk/2026/09/critical-avideo-vulnerability-could-expose-password-hashes-and-session-tokens-cve-2026-86190/ via @SystemTek_UK
Post summary
A blog post announces a critical AVideo vulnerability (CVE-2026-86190) that may expose password hashes and session tokens, but it does not provide a PoC, exploit code, patch, or evidence of active exploitation.
0000050
1.8K followersView on X
CVE@CVEnew46d
Disclosure
CVE-2026-86190 WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, … https://www.cve.org/CVERecord?id=CVE-2026-86190
Post summary
The message announces CVE‑2026‑86190, revealing a broken access control vulnerability in WWBN AVideo that exposes full user records, including sensitive data such as password hashes and recovery tokens.
00000726
58.1K followersView on X

Explore more

Back to dashboard