Executive brief
WWBN AVideo is a video platform and content management system used to host and manage video content. A flaw in the public channel page allows unauthenticated visitors to view videos that should be hidden—including unlisted videos and member-only content—regardless of the site administrator's privacy settings. Attackers can retrieve direct URLs and thumbnails of restricted videos, bypassing the operator's content protection controls.
Technical details
The vulnerability is a broken access control flaw resulting from two independent defects. First, the channelPlaylistItems.php endpoint hardcodes visibility flags that disable unlisted-video and group-membership checks when fetching videos for the public channel page, bypassing intended access controls. Second, the channelBody.php view fails to set the hidePrivateVideos property before passing it to a downstream renderer, causing a null-value check to fail open and skip group-restricted video filtering. Additionally, the Video::getAllVideos() library method ignores the showUnlisted parameter when an ID list is supplied, preventing fixes to the call sites from taking effect. Unauthenticated remote attackers can access /channel/<name> or /view/channelPlaylistItems.php directly to enumerate and retrieve metadata (URLs, thumbnails) of videos that should be hidden, even when the operator has enabled content-hiding settings. No authentication or user interaction is required.
Affected products
- WWBN AVideo 29.0 and earlier
Timeline
- 2026-08-19: disclosed
- 2026-09-03: advisory