Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the like.json.php endpoint, allowing logged-in users to record likes on password-protected and group-restricted videos. Attackers can submit like requests for videos they cannot watch to increment like counters and bypass access controls.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-12T13:16:52.913Z",
  "pubdate": "2026-09-12T13:16:52.913Z",
  "executiveSummary": "WWBN AVideo contains an improper access control vulnerability within the like.json.php endpoint, affecting all versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1.\nThe vulnerability allows authenticated users to interact with restricted content, specifically by programmatically liking videos that are otherwise protected by password requirements or group-level access restrictions.\nThis flaw stems from a lack of server-side authorization checks during the processing of like requests, permitting users to bypass logical access constraints intended to restrict interaction with private media.\nThe primary impact is the unauthorized manipulation of video metrics and the potential for metadata leakage regarding the existence or status of restricted content.\nExploitation requires a valid user account within the AVideo platform, as the application fails to validate the user's permission to view the target asset before committing the like interaction to the underlying database.\nThe vulnerability poses a risk to data integrity regarding engagement metrics and indicates a broader failure in the application's permission enforcement architecture.",
  "technicalDetails": "The vulnerability resides within the like.json.php file, which serves as the endpoint for processing user-submitted 'like' interactions on the AVideo platform. Analysis confirms that the endpoint processes incoming requests without performing a verification step to confirm if the authenticated session has the necessary privileges to view or interact with the specific video ID passed in the request body.\nIn a secure implementation, the endpoint should perform a secondary validation against the AVideo access control lists (ACLs) to verify that the video's visibility settings (such as password protection or specific group membership requirements) are respected before updating the database.\nThe attack flow proceeds as follows: First, the attacker identifies the video ID of a password-protected or restricted video, typically by interacting with the platform or traversing directory indices. Second, the attacker constructs an HTTP POST request targeting like.json.php, injecting the target video ID as a parameter. Third, the AVideo backend receives the request and, due to the missing access control logic, immediately executes the database transaction to increment the 'like' counter for the specified video ID.\nBecause the server-side code does not validate user permissions or access rights against the video's metadata during the execution of the like function, the application treats the request as legitimate regardless of whether the user is authorized to view the asset.\nThis vulnerability is classified as an improper access control flaw, likely stemming from an oversight in the backend architecture where administrative functions or global interaction endpoints assume that user sessions have already been validated for content access at the presentation layer, ignoring that direct API calls can bypass such frontend restrictions.\nThe post-exploitation impact includes the artificial inflation of like counts, which can be leveraged to manipulate content popularity algorithms, facilitate social engineering campaigns by making restricted content appear as though it has been validated or enjoyed by others, and potentially verify the existence of private content that is otherwise intended to remain hidden from unauthorized users.\nThe vulnerability affects all AVideo deployments utilizing code up to commit c3edcc274c389816d434acadac07ee78eaf330c1. There is no requirement for administrative or elevated privileges; standard authenticated user permissions are sufficient to trigger the flaw."
}