Executive brief
WWBN AVideo is a video streaming and management platform. A flaw in the playlist management feature allows authenticated users to add password-protected videos they cannot access to their own playlists, bypassing security restrictions. This could enable unauthorized access to restricted video content through playlist sharing.
Technical details
The vulnerability exists in the `playListAddVideo.json.php` endpoint, which fails to validate whether an authenticated user has permission to watch a video before adding it to a playlist. The `canAddVideoOnPlaylist()` function only checks if the user owns the playlist and optionally enforces a setting preventing users from creating playlists from other users' content, but does not call `User::canWatchVideo()`. An authenticated attacker can submit a POST request with a password-protected video ID and target playlist ID to add videos they cannot watch to their own playlist. The endpoint returns a success response (HTTP 200) and modifies the playlist. No patch was available at the time of public disclosure.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-28: disclosed
- 2026-09-12: advisory