Description

WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken() creates tokens without binding to user identity or purpose, and plugin/Gallery/view/sections.php issues valid tokens to unauthenticated visitors. Attackers can retrieve a token from the Gallery endpoint and use it to bypass authorization checks in other subsystems like view/hls.php to access restricted video content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-22T13:16:38.817Z",
  "pubdate": "2026-08-22T13:16:38.817Z",
  "executiveSummary": "WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability affecting token generation and validation mechanisms.\nThe vulnerability arises because the getToken() function generates tokens that lack proper cryptographic binding to user identity or specific operational purpose.\nThe plugin/Gallery/view/sections.php component inadvertently issues these valid tokens to unauthenticated visitors without requiring prior authentication or authorization.\nAttackers can leverage this flaw to harvest valid tokens directly from the Gallery endpoint and subsequently supply them to restricted subsystems, such as view/hls.php, effectively bypassing intended security controls.\nThe primary impact is unauthorized access to restricted video content and sensitive subsystems that rely on these weakly bound tokens for access control.\nThe attack requires network exposure to the AVideo instance, specifically the ability to interact with the Gallery endpoint to retrieve a token and the HLS viewing subsystem to execute the bypass.\nNo elevated privileges or prior authentication are required, enabling unauthenticated remote attackers to compromise content restriction mechanisms and view protected media assets.",
  "technicalDetails": "The vulnerability is rooted in the design and implementation of the token generation logic within the AVideo platform up to commit 9c39d8c8.\nSpecifically, the getToken() function fails to securely bind generated tokens to a specific user context, session, or intended functional purpose.\nWithout context binding, any token generated by this function is treated as universally valid across various subsystems that utilize the token validation mechanism.\nThe vulnerable component plugin/Gallery/view/sections.php exposes functionality that invokes or issues these tokens to incoming visitors, including unauthenticated entities accessing the public gallery view.\nThe attack flow proceeds in a sequential manner. First, an unauthenticated attacker sends an HTTP request to the vulnerable plugin/Gallery/view/sections.php endpoint.\nThe application processes this request and issues a valid token to the visitor without enforcing authentication checks or validating user permissions.\nSecond, the attacker extracts the issued token from the response or application context.\nThird, the attacker targets other restricted subsystems within the application, such as view/hls.php, which rely on the weak token validation logic for access control.\nBy presenting the harvested token to view/hls.php, the attacker successfully bypasses authorization checks designed to restrict access to private or protected video streams.\nThe affected versions include WWBN AVideo through commit 9c39d8c8, involving the specific functions and file paths noted.\nNetwork exposure is required, as the attacker must be able to reach the web application endpoints over the network.\nThe post-exploitation impact includes the unauthorized retrieval, streaming, and viewing of restricted video content, leading to a complete failure of the platform's content access control boundaries."
}