Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to properly authorize access to the videosAndroid.json.php endpoint, allowing unauthenticated guests to list password-protected videos with sensitive owner information. Attackers can retrieve video metadata including owner email, lastLogin, filename, and hashId by sending an unauthenticated GET request to the endpoint.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-12T13:16:53.320Z",
  "pubdate": "2026-09-12T13:16:53.320Z",
  "executiveSummary": "The WWBN AVideo platform, through commit c3edcc274c389816d434acadac07ee78eaf330c1, contains an improper authorization vulnerability within the videosAndroid.json.php endpoint.\nThis flaw allows unauthenticated, remote attackers to bypass access controls intended to protect restricted media content.\nThe vulnerability results in the unauthorized disclosure of sensitive metadata, including owner email addresses, user login activity timestamps (lastLogin), physical file identifiers (filename), and system-level hashIds.\nBy issuing a crafted GET request to the vulnerable endpoint, an adversary can enumerate private video resources, effectively circumventing password-protected access constraints.\nThis information disclosure constitutes a significant risk to user privacy and system reconnaissance, as exposed metadata can be leveraged for targeted phishing, credential stuffing, or further exploitation of the underlying file structure.\nThe vulnerability requires no authentication and is accessible via standard network requests, making it a low-complexity attack vector with high impact regarding data confidentiality.",
  "technicalDetails": "The vulnerability resides in the server-side implementation of the videosAndroid.json.php script within the WWBN AVideo architecture. The root cause is a failure to enforce session or token-based authentication/authorization checks before executing the data retrieval logic intended for mobile synchronization or metadata indexing.\nUnder normal operating conditions, this endpoint is intended to provide metadata for application-level integration; however, it lacks internal validation to verify whether the requesting user maintains proper access permissions for individual, password-protected video assets.\nThe attack flow commences when an unauthenticated actor sends a standard HTTP GET request to the vulnerable endpoint. Upon receipt, the application processes the request and queries the backend database for media records. Because the application logic fails to check the 'is_protected' or 'password' attributes against the requester's identity, the script proceeds to serialize and return the full metadata payload in JSON format.\nThe payload returned by the application exposes sensitive database fields. Specifically, the disclosure of owner email addresses, lastLogin timestamps, raw filename paths, and unique hashId values significantly elevates the security risk. The filename and hashId parameters could potentially facilitate path traversal or unauthorized resource downloads if additional vulnerabilities exist in the file retrieval handlers.\nThis vulnerability persists in all versions of the application codebase up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1. The absence of an access control gate allows for complete enumeration of the platform's video database by any remote, unauthenticated party with network connectivity to the web server.\nThe impact post-exploitation is characterized by a critical loss of data confidentiality. Attackers can perform large-scale scraping of user metadata, which provides a detailed map of the platform's content and user base. This information can be utilized to craft social engineering campaigns or identify specific targets based on user activity patterns indicated by the lastLogin metadata. Furthermore, the exposure of internal file paths may assist an adversary in mapping the server directory structure for further exploitation stages."
}