Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate watch permissions in the playListAddVideo.json.php endpoint when adding videos to playlists. Authenticated attackers can add password-protected videos they cannot watch to playlists they own by submitting the video ID and playlist ID parameters.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-12T13:16:52.080Z",
  "pubdate": "2026-09-12T13:16:52.080Z",
  "executiveSummary": "The vulnerability identified in WWBN AVideo is a broken access control flaw located within the playlist management functionality.\nSpecifically, the playListAddVideo.json.php endpoint fails to perform server-side permission checks when adding media content to user-owned playlists.\nThis allows authenticated attackers to bypass security restrictions intended to protect private or password-restricted videos.\nBy manipulating the request parameters, an attacker can associate unauthorized video assets with their own playlists.\nThe primary risk implication is the unauthorized inclusion of restricted content, potentially leading to metadata exposure or unauthorized playback if subsequent access controls are inconsistently applied.\nSuccessful exploitation requires an authenticated user account and knowledge of the target video ID and playlist ID.\nThis flaw highlights a lack of authorization verification in the server-side logic responsible for playlist modification.",
  "technicalDetails": "The vulnerability resides in the playListAddVideo.json.php script within the AVideo platform, affecting all versions up to commit c3edcc274c389816d434acadac07ee78eaf330c1.\nThe root cause is a failure to implement robust access control checks to validate whether the current authenticated user possesses the necessary permissions to view or interact with a specific video resource before adding it to a playlist.\nIn a secure implementation, the application should verify the video's privacy settings and the user's authorization to access the target video asset at the point of the playlist addition request.\nHowever, in the current version, the endpoint accepts user-supplied video_id and playlist_id parameters without validating the authorization context of the video.\nThe attack flow begins with an authenticated attacker identifying a video resource that is protected by a password or configured as private, which would typically be inaccessible or hidden from the user's view.\nThe attacker then crafts a POST request to the playListAddVideo.json.php endpoint. By supplying the target video ID in the request parameters alongside the identifier of a playlist owned by the attacker, the server proceeds to execute the database operation to append the unauthorized video to the playlist.\nBecause the server-side logic processes the request based purely on the possession of the playlist ID rather than the authorization status of the video ID, the system incorrectly concludes that the action is authorized.\nThe impact of this exploitation includes the ability to aggregate restricted media content into a collection owned by the attacker. While this may not automatically grant full viewing access to the content, it confirms the existence of restricted resources and circumvents the intended restriction that prevents users from interacting with unauthorized media.\nThe lack of server-side input validation and authorization checks allows for this bypass, demonstrating a failure to enforce the principle of least privilege within the playlist management module.\nThe vulnerability is limited to authenticated users; however, the scope of the exposure is significant in multi-user environments where content privacy is a requirement for standard operations."
}