What is GHSA-9xwf-rjxq-33w5?

GHSA-9xwf-rjxq-33w5 is a security advisory published by GitHub Security Advisories with Medium severity. WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist...

Which CVE IDs does GHSA-9xwf-rjxq-33w5 cover?

GHSA-9xwf-rjxq-33w5 covers the following CVE IDs: CVE-2026-90552. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9xwf-rjxq-33w5?

GHSA-9xwf-rjxq-33w5 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-9xwf-rjxq-33w5MediumCVSS 4.3

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist...

Vendor

GitHub Security Advisories

Published

September 12, 2026

Last Modified

September 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-90552 →

📋 Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the Playlists_schedules/list.json.php and Live/calendar.json.php endpoints, allowing authenticated and unauthenticated users to read private playlist schedule metadata. Attackers with canStream privileges or no authentication can retrieve schedule names, descriptions, timestamps, and playlist identifiers by querying these endpoints without ownership checks.

🔗 References (4)

https://github.com/WWBN/AVideo/security/advisories/GHSA-f4q2-49rm-rxh7
https://nvd.nist.gov/vuln/detail/CVE-2026-90552
https://www.vulncheck.com/advisories/wwbn-avideo-missing-authorization-via-playlists-schedules-list-json-php
https://github.com/advisories/GHSA-9xwf-rjxq-33w5