Description

WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through hardcoded visibility flags and an undefined property. Attackers can access the channel endpoint to retrieve sensitive video content that should be hidden, including full URLs to unlisted videos and thumbnails of member-only content, regardless of the operator's hidePrivateVideos setting.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-03T13:06:22.360Z",
  "pubdate": "2026-09-03T13:06:22.360Z",
  "executiveSummary": "WWBN AVideo contains a critical broken access control vulnerability on the public channel page, enabling unauthorized information disclosure.\nThe vulnerability allows unauthenticated visitors to bypass visibility restrictions, specifically targeting unlisted and group-restricted video content.\nThis flaw persists regardless of the 'hidePrivateVideos' configuration setting, effectively nullifying intended content privacy policies.\nAttackers can leverage this to retrieve sensitive metadata, direct video stream URLs, and thumbnails for restricted assets without any authentication.\nThe root cause stems from improper server-side validation of visibility flags and the handling of undefined object properties during the retrieval of video data.\nThe impact is significant, as it exposes proprietary or sensitive media to unauthorized parties, posing a risk to intellectual property, user privacy, and site security compliance.\nNo specific credentials or elevated privileges are required for an attacker to exploit this vulnerability, as the endpoint is exposed publicly and lacks robust access checks.",
  "technicalDetails": "The vulnerability originates from a failure in the server-side access control logic within the WWBN AVideo public channel page endpoint. When the application processes requests to list or display videos for a specific channel, it relies on client-supplied or improperly validated hardcoded visibility flags to determine whether a video should be rendered.\nSpecifically, the application logic fails to perform a rigorous verification of the user's authorization status against the video's privacy status when querying the database. Instead of verifying session-based group permissions or checking for authentication tokens before serving the video object, the application erroneously processes the request based on an undefined property and predictable visibility flag logic.\nThe attack flow begins with an unauthenticated user navigating to the vulnerable channel endpoint. By interacting with the channel interface, the user triggers a request that the application processes without ensuring the requester has the appropriate permissions for unlisted or restricted content. Because the application logic fails to strictly enforce the 'hidePrivateVideos' setting, the backend service populates the response with data objects containing restricted content.\nThis includes the full, direct URL path to the protected video streams and associated thumbnails. An attacker can systematically scrape these endpoints, effectively enumerating all videos hosted on a channel, including those explicitly marked as private or restricted to specific user groups. The exploitation does not require the attacker to have an active account or a session; the mere existence of the public-facing endpoint facilitates the information leakage.\nThe reliance on hardcoded visibility flags rather than robust, role-based access control (RBAC) mechanisms creates a bypass condition where the application treats unauthenticated requests as authorized by default if the data object structure is successfully retrieved. Consequently, the application leaks sensitive metadata that should be filtered at the controller layer before the response is serialized and returned to the client.\nPost-exploitation impact includes the unauthorized mass-downloading or public dissemination of private content, compromising the confidentiality of the platform's video library and potentially exposing sensitive or member-only information to the open internet."
}