Executive brief
waooAI waoowaoo is an AI-driven film and video production platform. A security flaw in the way the system handles media files allows unauthorized individuals to access private user-uploaded or AI-generated content, such as videos and images, without logging in. If an attacker can guess or obtain the internal name of a file, they can bypass ownership checks to view or download that media, potentially leading to the exposure of sensitive intellectual property or private project assets.
Technical details
An improper authorization vulnerability exists in waooAI waoowaoo up to 0.4.1 within the Media Handler component. The function 'stablePublicIdFromStorageKey' in 'src/lib/media/hash.ts' generates deterministic public identifiers for media assets based solely on their storage keys using a SHA-256 hash. Because the application lacks ownership checks (such as userId or projectId) in the 'MediaObject' schema and the '/m/[publicId]' route, an unauthenticated attacker who knows or can predict a storage key can retrieve the associated media. Additionally, the '/api/storage/sign' endpoint allows unauthenticated signing of arbitrary storage keys. As of the advisory date, no official patch has been released by the vendor.
Affected products
- waooAI waoowaoo up to 0.4.1
Timeline
- 2026-06-10: disclosed: Issue reported to the project via GitHub issue #201
- 2026-07-13: advisory: CVE published by VulDB/NVD