Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to authorize access to the adsInfo API endpoint, allowing unauthenticated attackers to retrieve password-protected video owner identifiers. Attackers can call the adsInfo API with a videos_id parameter to obtain the owner's user ID and personalized ad creative URLs without authentication or permission checks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-12T13:16:51.523Z",
  "pubdate": "2026-09-12T13:16:51.523Z",
  "executiveSummary": "WWBN AVideo, up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a critical Broken Access Control vulnerability within the adsInfo API endpoint.\nThis flaw allows unauthenticated remote attackers to bypass authorization mechanisms to retrieve sensitive metadata related to password-protected video content.\nThe vulnerability exposes the unique user identifiers of video owners and personalized ad creative URLs.\nBy manipulating the API request parameters, an attacker can bypass intended permission checks, leading to unauthorized information disclosure.\nThe risk implication is significant as it provides reconnaissance data that could facilitate further targeted attacks, such as account takeover attempts or social engineering against content creators.\nThe vulnerability is remotely exploitable without authentication, requiring only network connectivity to the AVideo instance.",
  "technicalDetails": "The root cause of this vulnerability is an improper implementation of access control checks within the adsInfo API endpoint of the WWBN AVideo application.\nThe application fails to perform mandatory session validation or authorization checks when processing incoming requests directed at this endpoint.\nSpecifically, the endpoint allows the submission of a 'videos_id' parameter, which the backend processes to query the database for associated ad metadata.\nThe exploitation process begins when an attacker identifies a target 'videos_id', which can often be enumerated sequentially or obtained through public indexing.\nThe attacker sends a specially crafted GET or POST request to the 'adsInfo' API component, passing the chosen 'videos_id' as a parameter.\nBecause the server-side code does not verify whether the current request origin is authenticated or authorized to view the requested resource, the application proceeds to fetch the associated database records regardless of whether the video is public or password-protected.\nThe application then reflects the database query results back to the user in the API response. This response includes sensitive information such as the unique user ID of the video owner and URLs corresponding to personalized ad creatives.\nThis behavior constitutes an Insecure Direct Object Reference (IDOR) variant where the lack of an authorization layer permits unauthorized object access.\nThe exposure of owner user IDs serves as a reconnaissance vector, providing attackers with valid internal identifiers that can be used to map user relationships or perform further attacks against user-specific endpoints.\nFurthermore, the disclosure of personalized ad creative URLs may provide insights into private marketing campaigns or lead to the unauthorized distribution of content.\nThis vulnerability is present in all versions of WWBN AVideo up to commit c3edcc274c389816d434acadac07ee78eaf330c1, indicating that the authorization logic was omitted or incorrectly implemented in this specific component.\nThe lack of authentication requirements allows this attack to be performed automatedly and at scale, exposing the entire database of video-to-owner mappings to any unauthenticated actor on the network."
}