Executive brief
AVideo is a video sharing and streaming platform. The RSS feed generator exposes channel owner email addresses to anyone without authentication, allowing attackers to collect contact information for all creators, which can be used for account takeover attempts and phishing campaigns targeting those accounts.
Technical details
The vulnerability is an information exposure (CWE-200, CWE-359) due to missing authorization (CWE-862) in feed/index.php. The endpoint disables login requirements but fails to filter sensitive user data, loading the full user record and emitting the owner's email address in RSS elements (itunes:email and itunes:author) without any authorization check. An unauthenticated attacker can supply a public channel name via GET parameter to retrieve the corresponding channel owner's email address, and enumerate all creator emails by iterating through public channel names. The vulnerability affects versions through commit 9c39d8c8; no patch is currently available. The attack requires only network access and no user interaction.
Affected products
- WWBN AVideo through commit 9c39d8c8b4c1f75540788d6b391740852ceb0732
Timeline
- 2026-08-07: disclosed
- 2026-08-22: advisory