Description

AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner email addresses by supplying a public channel name parameter. Attackers can enumerate all creator email addresses by iterating through public channel names and extract them from the itunes:email and itunes:author RSS elements, enabling account takeover attempts and phishing campaigns.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-22T13:16:37.977Z",
  "pubdate": "2026-08-22T13:16:37.977Z",
  "executiveSummary": "An information exposure vulnerability exists in AVideo up to commit 9c39d8c8, specifically within the feed/index.php component. This security flaw allows unauthenticated remote attackers to harvest sensitive channel owner email addresses by querying the application with public channel name parameters. The affected system exposes this Personally Identifiable Information (PII) directly through RSS response elements such as itunes:email and itunes:author.\nThe business impact of this exposure is significant, as it facilitates targeted enumeration of content creator profiles across the platform. Threat actors can leverage the harvested email addresses to orchestrate sophisticated phishing campaigns, credential-stuffing attacks, and subsequent account takeover attempts against platform administrators and content creators.\nExploitation requires no prior authentication, specific privileges, or complex user interaction, lowering the barrier to entry for malicious actors. Attackers can automate the enumeration process by systematically iterating through valid public channel names, making mass data harvesting efficient and scalable over the network.",
  "technicalDetails": "The vulnerability resides in the feed/index.php file of AVideo, which processes RSS syndication feeds for public channels. The root cause of the information exposure is the insecure inclusion of sensitive user account metadata within publicly accessible RSS generation logic without proper access controls or data minimization.\nWhen a request is submitted to feed/index.php containing a targeted public channel name parameter, the underlying application queries the database to retrieve channel details and associated user profile information. The component then dynamically constructs an XML response incorporating RSS syndication elements.\nSpecifically, the script populates the itunes:email and itunes:author elements with the private email addresses and author identifiers linked to the channel owner account. Because these endpoints lack authentication and authorization checks, any network-adjacent or remote attacker can issue arbitrary HTTP requests to retrieve this sensitive data.\nThe attack flow proceeds as follows: First, the unauthenticated attacker identifies or generates a list of public channel names associated with the AVideo instance. Second, the attacker sends automated HTTP GET requests to feed/index.php, appending the channel name as a query parameter. Third, the application processes the request and returns an XML-formatted RSS feed containing the channel owner's email address in the clear within the itunes:email node.\nFinally, the attacker parses the returned XML payload to extract the exposed PII. By scripting this sequence, malicious actors can systematically enumerate all creator email addresses registered on the platform, establishing a comprehensive target list for downstream social engineering or credential compromise operations."
}