Executive brief
WWBN AVideo is a self-hosted video platform that allows users to organize and share videos through playlists. An unauthenticated attacker can query the video_from_program API endpoint without proper credentials to retrieve private playlist metadata and video titles, including password-protected content. This exposure of sensitive playlist ownership and video information could enable further targeted attacks or unwanted information disclosure about private media collections.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the API.php plugin where the video_from_program API endpoint fails to validate playlist ownership before exposing playlist metadata and video contents. The vulnerable code loads playlist information via PlayLists::getOnlyVideosAndAudioIDFromPlaylistLight() and new PlayList() without any ACL verification, unlike a similar sibling method get_api_program which correctly calls forbidIfItIsNotMyUsersId(). An unauthenticated network attacker can craft a GET request to /plugin/API/get.json.php with APIName=video_from_program and a playlists_id parameter to enumerate private playlist names, owner user IDs, channel names, and video titles. The attack requires no authentication, special privileges, or user interaction. No patch was available at the time of advisory publication.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-28: disclosed
- 2026-09-12: advisory