CVE-2026-85155 is a high severity SQL injection in WWBN AVideo. An unauthenticated caller can pick the sort column used by the channels API and learn secrets such as password hashes from the order of results. The GitHub advisory lists no patched version, so reduce exposure of the endpoint and watch the project for a fix.
What's affected
- Product: WWBN AVideo, endpoint
get.json.phpwithAPIName=channels. - GitHub advisory (GHSA-pmmj-6425-gpgh): current at the time of writing (commit e01e41ecc) and earlier; patched versions: none.
- VulnCheck advisory: AVideo up to and including 29.0.
- Fixed version: not confirmed in either source. Check the advisory and the AVideo releases page before you rely on any version number.
Severity in the record: High, CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The GitHub advisory rates it High. VulnCheck scores it 8.7 under CVSS v4, which is higher than the 7.5 in the record because the two use different scoring versions.
Weakness class: CWE-89 (SQL Injection).
How to check if you're exposed
Find out which AVideo build you run, then see whether the channels API is reachable without a login.
- Note your version or commit. In a git checkout,
git log -1 --format=%hprints the short commit id to compare with e01e41ecc. - From outside your network, ask whether
/plugin/API/get.json.phpanswers anonymous requests. If you do not use the public channels API, it should not. - Search web server logs for requests to
get.json.phpthat carryAPIName=channelstogether with unusual sort or order parameters, especially from addresses that never log in. - Check whether database error text ever appears in HTTP responses. The advisory says a failed query echoes the SQL statement, so any such response is also an information leak.
What to do now
- Look for a fixed release or commit on the AVideo repository and the advisory page, and upgrade as soon as one exists.
- Until then, block anonymous access to the channels API at your reverse proxy or web application firewall if you do not need it.
- Turn off display of database errors in production so a bad query cannot reveal the statement or schema.
- Treat password hashes and recovery tokens as exposed if the endpoint was public. Force a password reset for admin and high privilege accounts, and expire recovery tokens.
- Record the version you run and set a reminder to recheck the advisory weekly.
Why it matters
The code builds an ORDER BY clause from a request parameter. A character filter removes quotes and parentheses, so this is not a general injection, but it still lets the caller name any column from the joined users table. The advisory explains that the response never contains the secret itself. The order of the rows is a function of it, and the caller controls both the column and the direction. That is enough to learn about stored values.
The lesson reaches beyond AVideo. Column names and sort directions are identifiers, not values, so parameter binding does not protect them. Map user input to an allowlist of sortable fields instead of filtering characters. This is CWE-89 in the usual taxonomy, and the record does not mark it as exploited in the wild.
Try it yourself
A dynamic scan of a web app is one way to find endpoints that answer without a login. This demo shows the flow.
Click through it at your own pace, or open it full screen.
Quick check
Is there a patched version of AVideo for CVE-2026-85155?
The GitHub advisory lists none, and VulnCheck lists versions up to 29.0 as affected. Check the advisory again for updates, and use access controls on the endpoint in the meantime.
Sources
Last reviewed: 18 October 2026.
