Description

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session identifier to hijack viewer sessions, including administrator accounts, and obtain sensitive personal data for all video viewers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-05T13:18:14.150Z",
  "pubdate": "2026-09-05T13:18:14.150Z",
  "executiveSummary": "WWBN AVideo is affected by a critical broken access control vulnerability within the videoViewsInfo endpoint. This flaw permits unauthenticated remote attackers to retrieve sensitive user information, including password hashes, account recovery tokens, and active session identifiers.\nThe vulnerability stems from improper authorization checks when the hash parameter is supplied to the endpoint. By exploiting this flaw, an attacker can bypass authentication mechanisms to extract full user records from the underlying database.\nThe impact is severe, as the exposure of session identifiers facilitates unauthorized session hijacking, potentially leading to full administrative account takeover. Furthermore, the leakage of password hashes and recovery tokens poses a significant risk of long-term account compromise and massive exfiltration of private user data. The vulnerability is publicly accessible and requires no prior authentication, significantly lowering the barrier to exploitation for threat actors.",
  "technicalDetails": "The vulnerability resides in the videoViewsInfo endpoint of the WWBN AVideo platform. The root cause is a failure to perform server-side validation of the requester's identity when a specific 'hash' parameter is provided in the HTTP request. Instead of enforcing strict access controls, the application logic incorrectly assumes that the presence of this parameter is sufficient evidence of authorization, granting the caller access to data intended only for the account owner or administrative personnel.\nThe attack flow begins with an unauthenticated attacker sending a crafted HTTP request to the videoViewsInfo endpoint. By appending or manipulating the 'hash' parameter within the query string, the attacker triggers an improper conditional branch in the backend code responsible for retrieving user data. The application processes this request and, due to the missing access control checks, queries the database for user profile information associated with the requested scope.\nThe endpoint response includes comprehensive user objects, which contain highly sensitive fields such as plaintext-equivalent password hashes, account recovery tokens, and active live session identifiers. Once this data is obtained, the attacker can parse the JSON or serialized response to extract session tokens. These tokens can be injected into the attacker's own browser session to impersonate the target user, effectively bypassing existing authentication sessions without requiring valid credentials.\nThe scope of this vulnerability extends to all viewers registered within the AVideo platform. Because the endpoint does not adequately restrict the breadth of the returned data, an attacker can iterate through user identifiers to systematically scrape the entire user database. This results in the bulk exfiltration of PII (Personally Identifiable Information) and security credentials. Given that session hijacking can target administrator accounts, the attacker may gain the ability to reconfigure the platform, upload malicious content, or further persist their access within the server environment. This vulnerability represents a failure of the principle of least privilege at the API boundary, exacerbated by the transmission of highly sensitive authentication artifacts in response to unauthenticated requests."
}