CVE-2026-90551

WWBN AVideo (through commit c3edcc274) has a missing authorization flaw in its video_from_program API endpoint, which fails to validate playlist ownership before returning results. An unauthenticated network attacker can query the endpoint to enumerate private playlist names, owner information, a...