CVE-2026-92585: Missing Authorization

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. Attackers can submit like and dislike requests to increment vote counters on...

CVE-2026-33513: Improper Limitation of a Pathname to a Restricted Directory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated API endpoint APIName=locale concatenates user input into an include path with no canonicalization or whitelist. Path traversal is accepted, so arbitrary PHP files under the web root can be...