Missing Authorization in AVideo Scheduler Email Access

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token. Attackers can enumerate scheduler jobs, read private live titles and email addresses, and trigger email sending by supplying any valid daily token obtained from Live pages.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

WWBN AVideo contains a missing authorization vulnerability (CWE-862) in its scheduler email functionality that allows unauthenticated attackers to bypass access controls. By obtaining any valid daily token from public Live pages, attackers can access the sendEmail.json.php endpoint to enumerate scheduler jobs, extract sensitive information including private live titles and email addresses, and trigger unauthorized email sending. This affects any organization running vulnerable versions of AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1, particularly those exposing Live pages publicly or with minimal access restrictions. The vulnerability is particularly dangerous because the authentication bypass requires only a commonly accessible token, making exploitation trivial and widespread.

Casky's 283 mapped security skills leverage Claude AI's extended reasoning to detect the attack patterns underlying TA0004 (Privilege Escalation) and TA0006 (Credential Access) techniques. Practitioners using Casky would observe detections around: (1) unexpected access to /plugin/Scheduler/sendEmail.json.php without proper session authentication, (2) enumeration patterns querying scheduler job metadata, (3) extraction of email addresses and private live titles indicating information disclosure, and (4) anomalous email trigger requests originating from unauthenticated sources. Claude's reasoning identifies that attackers are leveraging improper access control checks to escalate from unauthenticated to privileged scheduler operations, combining initial token harvesting (credential access) with unauthorized administrative actions, enabling comprehensive threat hunting across your AVideo infrastructure.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-90537.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-90537

Casky has 283 skills that investigate the attack patterns behind CVE-2026-90537. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn