Description

WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a program_id parameter is supplied. Attackers can enumerate playlist identifiers and retrieve unlisted and group-restricted videos by requesting the RSS feed with any visible playlist id, including empty playlists that return the entire site's hidden video catalogue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-03T13:06:22.503Z",
  "pubdate": "2026-09-03T13:06:22.503Z",
  "executiveSummary": "WWBN AVideo is affected by a critical broken access control vulnerability residing in the unauthenticated feed/index.php endpoint. The flaw enables unauthorized retrieval of sensitive video content by bypassing established visibility and privacy constraints.\nSpecifically, when a program_id parameter is supplied to the RSS feed generation mechanism, the application fails to perform necessary per-video authorization checks. This oversight allows unauthenticated attackers to systematically enumerate playlist identifiers.\nThe impact is significant, as the vulnerability facilitates the unauthorized exposure of unlisted and group-restricted videos. By querying existing or even empty playlist identifiers, an attacker can trigger the application to disclose the entire site's hidden video catalogue, effectively rendering privacy settings obsolete.\nThis vulnerability poses a high risk to data confidentiality and intellectual property, as restricted media assets become globally accessible to any unauthenticated network actor. No specific authentication is required for exploitation, and the attack vector is exposed via standard web protocols, making it trivial to automate through script-based enumeration.",
  "technicalDetails": "The vulnerability is situated within the feed/index.php component of the WWBN AVideo platform. The root cause of this security flaw is an insecure implementation of access control logic within the RSS feed generation functionality.\nDuring normal operation, the application is expected to evaluate the visibility settings of each video object before including it in the generated feed. However, the presence of the program_id parameter in the GET request triggers a flawed code path. When this parameter is supplied, the application backend bypasses the standard authentication and authorization middleware that typically verifies whether the current user (including unauthenticated guests) has sufficient privileges to access specific video resources.\nThe exploitation flow begins with an attacker performing reconnaissance to identify valid or empty playlist identifiers on the target instance. Because the application does not implement rate limiting or request validation on the feed/index.php endpoint, an attacker can programmatically iterate through integer-based identifiers.\nWhen a request is submitted to feed/index.php with a program_id, the server-side logic fails to enforce restrictions on the resulting video objects. In instances where a program_id points to an empty playlist, the application erroneously returns the entire catalogue of videos, including those marked as 'unlisted' or 'group-restricted'. This suggests that the inclusion of the program_id parameter forces the application into a 'debug' or 'administrative' view that assumes the user has high-level access rights, ignoring the context of the requesting session.\nThe network exposure is absolute, as the endpoint is accessible without credentials. An attacker can leverage standard HTTP GET requests to extract metadata and direct stream URLs for restricted content. The post-exploitation impact includes the mass scraping of private video libraries, potential exposure of proprietary content, and a complete compromise of the platform's multi-tenant or group-based privacy model. The lack of secondary verification within the function that populates the RSS XML structure ensures that the bypass remains persistent across all requests containing the tainted parameter."
}