THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-86190 (CRITICAL 9.1) — WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the d

[NVD] CVE-2026-86190 (CRITICAL 9.1) — WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the d

mednvdPublished 2026-09-05

CVE-2026-86190 CVSS: 9.1 CRITICAL Published: 2026-09-05T13:18:14.150

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session identifier to hijack viewer sessi

Indicators of compromise

CVE-2026-86190cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-86190