Executive brief
WWBN AVideo is a web-based video platform for hosting and managing video content. An unauthenticated attacker can bypass visibility restrictions on videos by accessing the RSS feed endpoint with a playlist parameter, gaining access to unlisted videos and videos restricted to specific user groups without requiring authentication or authorization.
Technical details
The vulnerability is a broken access control flaw in the feed/index.php endpoint, which is accessible without authentication. When a program_id (playlist ID) parameter is provided, the endpoint calls Video::getAllVideos() with ignoreGroup=true and showUnlisted=true, disabling per-video visibility checks. Additionally, Video::getAllVideos() has a second defect: it hardcodes showUnlisted=true when supplied with a video ID list, making it impossible for callers to enforce the unlisted restriction. An attacker can enumerate playlist IDs and retrieve restricted videos; even an empty playlist returns the entire site's hidden video catalogue. The vulnerability requires only network access and no authentication or user interaction.
Affected products
- WWBN AVideo 29.0 and earlier
Timeline
- 2026-08-19: disclosed
- 2026-09-03: advisory