WWBN AVideo Vulnerability Tracked as CVE-2026-90537

What happened

A security weakness in WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is being tracked as CVE-2026-90537. CVE-2026-90537 affects WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1. The reported path can be reached without an authenticated session, increasing exposure wherever the vulnerable interface is network reachable.

Unauthenticated exposure changes the operational response because defenders cannot assume that an attacker would already need a compromised account before reaching the vulnerable function. CVE-2026-90537 puts affected WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 systems at risk when the vulnerable service or function is reachable from attacker-controlled network traffic.

CVE-2026-90537 currently carries a HIGH 8 2 severity signal in the retained vulnerability data. WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail. php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token.

The available description indicates that the vulnerable path can be reached remotely or from an untrusted network, so the exposure of WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 becomes part of the attack condition. Organizations using WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 should first confirm whether affected versions are externally or internally reachable from networks an attacker could access.

The important point is that running an affected version of WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 creates exposure, while an actual compromise still depends on whether the attacker can reach the trigger conditions described above. The issue currently carries a HIGH 8 2 severity signal in the CyberDeltaForce record.

The operational question is not simply the severity score, but whether the affected component is deployed, reachable, business-critical and protected by compensating controls. The current severity assessment is HIGH 8 2. Real risk depends on exposure, exploitability, compensating controls and the importance of the affected asset—not the CVSS number alone.

Inventory the affected product deployments and confirm whether the affected component and vulnerable release are present. Apply the vendor patch or mitigation for CVE-2026-90537 and validate the affected path after remediation. The current source set does not report active exploitation of CVE-2026-90537; that status should be monitored rather than treated as proof that exploitation is impossible.

The most useful validation after remediation is to confirm that the vulnerable path no longer permits the reported behavior and that the deployed release matches the vendor's corrected version. So far, researchers have not reported exploitation, but that can change as vendor, government or threat-intelligence reporting develops.