Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in playlistsFromUser.json.php that allows unauthenticated attackers to read private playlists by requesting another user's identifier. Attackers can retrieve Favorite and Watch Later playlists belonging to other users due to improper cache keying that conflates requests across different user contexts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-12T13:16:51.807Z",
  "pubdate": "2026-09-12T13:16:51.807Z",
  "executiveSummary": "The WWBN AVideo platform, through commit c3edcc274c389816d434acadac07ee78eaf330c1, is susceptible to an unauthorized data disclosure vulnerability located in the playlistsFromUser.json.php file.\nThe vulnerability is classified as a missing authorization flaw, allowing unauthenticated attackers to gain unauthorized access to private user data.\nBy manipulating the user identifier within a request, an attacker can illicitly retrieve private 'Favorite' and 'Watch Later' playlists associated with other users.\nThe root cause is identified as improper cache keying, which fails to isolate data based on user context, leading to request conflation.\nThis flaw poses a significant risk to user privacy and data confidentiality, as it bypasses standard access control mechanisms. Successful exploitation does not require prior authentication, making the system vulnerable to automated scanning and data harvesting attacks by external actors.\nThe impact includes the exposure of sensitive user preferences and viewing habits, which could be leveraged for reconnaissance or further targeting of specific users within the ecosystem.",
  "technicalDetails": "The vulnerability resides in the server-side processing logic of the playlistsFromUser.json.php script. This component is designed to fetch playlist information for a given user identifier; however, it lacks the necessary authorization checks to verify that the requestor has permission to access the requested data.\nThe underlying flaw stems from an insecure cache implementation. The application utilizes a caching mechanism for user playlists that is keyed improperly. Specifically, the cache key generation logic does not incorporate the session-level or requester-level identity required to segregate private data. Consequently, the application returns cached, private playlist results for any user identifier provided in the request parameters, regardless of whether the requester is the owner of that data or even logged into the system.\nThe attack flow proceeds as follows: An unauthenticated attacker identifies the target user's identifier (often accessible via public profile pages or sequential ID enumeration). The attacker then crafts a request to the playlistsFromUser.json.php endpoint, substituting the target's ID in the user identifier parameter. Because the server fails to validate the requester's permissions and retrieves data based on a globally accessible cache key, the backend returns the 'Favorite' and 'Watch Later' playlist details of the targeted user. The response is processed and returned to the attacker in JSON format, providing full visibility into private content collections.\nThis vulnerability is present in versions of WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1. The absence of an authorization layer at the entry point of the script means that the application treats every request for user playlist data as a public request. Given the network-exposed nature of this endpoint, the vulnerability is highly accessible to any remote attacker with network connectivity to the application instance.\nPost-exploitation, the attacker gains the ability to map individual viewing interests across the entire user base of the platform. This information exposure facilitates social engineering or targeted phishing efforts, as the attacker now possesses knowledge of the private content libraries and preferences of specific users without requiring administrative access or legitimate credentials."
}