Executive brief
AVideo is an open-source video hosting platform that allows administrators to protect videos with passwords. The PlayerSkins module contains a flaw in seo.php that bypasses password protection, allowing unauthenticated attackers to directly access the MP4 URLs of password-protected videos and read the video content without providing a password. This exposes sensitive video media that should require authentication to view.
Technical details
The vulnerability is a missing authorization check in plugin/PlayerSkins/seo.php. The vulnerable code accepts a video ID and calls getSources() to return playable video sources without verifying the caller's permission or validating the video's password, unlike the normal watch flow which enforces User::canWatchVideo() and videoPasswordIsGood() checks. An unauthenticated attacker can send an HTTP request to seo.php with a video ID to obtain the direct MP4 URL of any password-protected video. The attacker can then use the returned URL to read the protected media bytes directly, since the media server's .htaccess rules grant public access to MP4 files. The flaw affects AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master branch, August 23, 2026) with no patched version available at disclosure.
Affected products
- WWBN AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-26: disclosed: GitHub security advisory GHSA-wq9m-cfw6-4gh5 published
- 2026-09-10: advisory: CVE-2026-88876 published