Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the Bookmark plugin getBookmarks.json.php endpoint, allowing unauthenticated attackers to read chapter names from password-protected videos. Attackers can query the endpoint with a video ID parameter to retrieve sensitive chapter metadata without authentication or password verification.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-12T13:16:53.050Z",
  "pubdate": "2026-09-12T13:16:53.050Z",
  "executiveSummary": "WWBN AVideo, through commit c3edcc274c389816d434acadac07ee78eaf330c1, contains an improper access control vulnerability within the Bookmark plugin's getBookmarks.json.php endpoint.\nThe vulnerability allows unauthenticated remote attackers to bypass authorization checks and retrieve sensitive chapter metadata associated with password-protected videos.\nBy manipulating the video ID parameter in requests directed at the vulnerable endpoint, an attacker can extract protected information without valid credentials.\nThis flaw represents a failure in the application's security model regarding data access control for protected media resources.\nThe primary risk involves the unauthorized disclosure of information, potentially exposing confidential chapter titles or structured video content data that should be restricted to authenticated or authorized users.\nExploitation requires no special privileges or pre-existing sessions, lowering the barrier for entry for unauthorized actors seeking to enumerate private video metadata.",
  "technicalDetails": "The vulnerability resides in the getBookmarks.json.php file, which serves as an endpoint for the AVideo Bookmark plugin. The root cause of this flaw is the absence of robust server-side authorization logic within this script. Specifically, the application fails to verify whether the requesting user possesses the requisite permissions to access the metadata for a requested video ID.\nIn a secure implementation, the application should validate the user's session and the specific permissions associated with the requested media object—such as password protection status—before returning any data. However, the affected endpoint processes requests by directly querying the database based on the provided video ID parameter without performing an access check against the media's visibility settings or password requirements.\nThe attack flow proceeds as follows: First, the attacker identifies a target video ID, which may be discovered through public indexing or enumeration. Second, the attacker crafts a GET or POST request to /plugin/Bookmark/getBookmarks.json.php, including the targeted video ID as an argument. Third, the backend script executes a database query to retrieve all associated chapter metadata for the specified ID. Finally, the application returns the requested chapter information—such as titles and timestamps—as a JSON response to the unauthorized attacker.\nBecause the logic in getBookmarks.json.php bypasses the standard authentication gatekeepers used by the core AVideo framework, the endpoint treats the request as legitimate regardless of the video's actual visibility or password-protected status. This allows for the mass enumeration of chapter metadata across private or restricted video collections. The vulnerability is persistent across all versions of the AVideo software up to commit c3edcc274c389816d434acadac07ee78eaf330c1.\nThe post-exploitation impact is primarily informational disclosure. While the vulnerability does not directly grant access to the underlying media stream or the password itself, it allows the unauthorized extraction of descriptive metadata that may disclose sensitive content identifiers, organizational structure, or internal naming conventions intended to be private."
}