Executive brief
WWBN AVideo is a video hosting and streaming platform. An unauthenticated attacker can access a backend API endpoint that lists password-protected videos along with sensitive owner information including email addresses and login timestamps. This allows attackers to enumerate private videos and harvest personally identifiable information without any authentication.
Technical details
The vulnerability is a missing authorization check (CWE-862) combined with sensitive information exposure (CWE-200) in the videosAndroid.json.php endpoint. The endpoint calls Video::getAllVideos(Video::SORT_TYPE_VIEWABLE) and returns complete video records including the joined owner row with email, lastLogin, filename, and hashId for all viewable videos, including password-protected ones. Unlike the regular videos.json.php endpoint which returns total=0 for guest users, videosAndroid.json.php does not enforce authorization, allowing unauthenticated GET requests to retrieve restricted video metadata. No authentication is required and the attack is network-reachable with low complexity. The patch status was unfixed at the time of public disclosure.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-28: disclosed
- 2026-09-12: advisory