CVE-2026-35179

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the SocialMediaPublisher plugin exposes a publishInstagram.json.php endpoint that acts as an unauthenticated proxy to the Facebook/Instagram Graph API. The endpoint accepts user-controlled parameters including an access token, container ID, and Instagram account ID, and passes them directly to the Graph API via InstagramUploader::publishMediaIfIsReady(). This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform's own credentials.

• CWE-862

• https://github.com/WWBN/AVideo/security/advisories/GHSA-x9w5-xccw-5h9wExploit, Mitigation, Vendor Advisory

Published

Apr 6, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35173Chyrp Lite is an ultra-lightweight blogging engine. Prior to…6.5
• CVE-2026-35174Chyrp Lite is an ultra-lightweight blogging engine. Prior to…7.2
• CVE-2026-35175Ajenti is a Linux and BSD modular server admin panel. Prior …6.5
• CVE-2026-35176openFPGALoader is a utility for programming FPGAs. In 1.1.1 …7.1
• CVE-2026-35177Vim is an open source, command line text editor. Prior to 9.…7.1
• CVE-2026-35178Workbench is a suite of tools for administrators and develop…9.8
• CVE-2026-3518OS Command Injection Remote Code Execution Vulnerability in …7.2
• CVE-2026-35180WWBN AVideo is an open source video platform. In versions 26…4.3
• CVE-2026-35181WWBN AVideo is an open source video platform. In versions 26…4.3
• CVE-2026-35182Brave CMS is an open-source CMS. Prior to 2.0.6, this vulner…8.8
• CVE-2026-35183Brave CMS is an open-source CMS. Prior to 2.0.6, an Insecure…5.4
• CVE-2026-35184EcclesiaCRM is CRM Software for church management. Prior to …9.8