Executive brief
AVideo is a video hosting and streaming platform. The like/dislike voting feature in its API endpoint fails to verify that logged-in users have permission to watch the videos they are voting on. This allows any authenticated user to artificially inflate or deflate vote counts on password-protected or group-restricted videos they cannot access, potentially manipulating video popularity metrics and analytics.
Technical details
The vulnerability exists in plugin/API/API.php where the like(), dislike(), and removelike() API methods validate that a user is logged in via User::isLogged() but fail to call User::canWatchVideo() to verify the user has permission to access the target video. An authenticated attacker can call the set.json.php endpoint with APIName parameters (like, dislike, removelike) and a videos_id parameter for any video, regardless of access restrictions (password-protected or group-restricted). The request succeeds and increments vote counters on videos the attacker cannot watch. This is a missing authorization check (CWE-862) requiring only network access and valid authentication credentials, with low complexity. The impact is limited to integrity of vote counts with no confidentiality or availability impact.
Affected products
- WWBN AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1)
Timeline
- 2026-09-01: disclosed
- 2026-09-16: advisory