Is CVE-2026-59256 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-59256?

CVE-2026-59256 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-59256

Description

WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken() creates tokens without binding to user identity or purpose, and plugin/Gallery/view/sections.php issues valid tokens to unauthenticated visitors. Attackers can retrieve a token from the Gallery endpoint and use it to bypass authorization checks in other subsystems like view/hls.php to access restricted video content.