Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to check user authorization in the PlayerSkins mediaSession.json.php endpoint before returning video metadata. Unauthenticated attackers can request the endpoint with a video ID parameter to retrieve password-protected video titles and owner email addresses without authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-12T13:16:53.467Z",
  "pubdate": "2026-09-12T13:16:53.467Z",
  "executiveSummary": "The WWBN AVideo platform exhibits a critical information disclosure vulnerability within the PlayerSkins module. The issue originates from an improper authorization check in the mediaSession.json.php endpoint, which fails to validate the requester's session or permissions before exposing sensitive metadata.\nThis vulnerability allows unauthenticated remote attackers to query the endpoint with arbitrary video identifiers. Successful exploitation results in the unauthorized retrieval of restricted content, specifically password-protected video titles and the private email addresses associated with video owners.\nThe flaw impacts all versions of WWBN AVideo up to commit c3edcc274c389816d434acadac07ee78eaf330c1. The risk is significant, as it facilitates unauthorized data harvesting, potential privacy violations, and reconnaissance for further attacks. Exploitation requires no authentication, making it trivial for remote actors to automate the scraping of sensitive information across the application's database. Organizations deploying affected versions remain at high risk until appropriate access control mechanisms are enforced at the API level.",
  "technicalDetails": "The vulnerability resides within the mediaSession.json.php script located in the PlayerSkins component of the WWBN AVideo application. The root cause is a failure to implement server-side session validation or authorization checks prior to data retrieval and serialization. In a secure architecture, an endpoint responsible for returning media metadata—especially for content protected by passwords—must verify the user's current session state, ACL (Access Control List) permissions, and ownership status.\nIn this implementation, the endpoint accepts a video ID parameter directly from the user-supplied input. Upon receiving this parameter, the script performs a database query to fetch metadata associated with the provided ID. Critically, the logic lacks any conditional branching to check if the video content is marked as private or password-protected before returning the results to the client. Consequently, the application proceeds to serialize the sensitive metadata into a JSON format and transmit it over the network to the unauthenticated caller.\nThe attack flow proceeds as follows: First, the attacker identifies a target instance of WWBN AVideo. Second, the attacker interacts directly with the mediaSession.json.php endpoint by supplying a specific 'id' parameter via an HTTP GET request. Third, the server-side application processes the request, bypasses all authorization logic, and retrieves the database record for the requested video. Finally, the server echoes the video title and the owner's registered email address back to the attacker in the HTTP response body.\nBecause the application does not distinguish between authenticated administrators, authorized viewers, and anonymous users, the endpoint serves as an open oracle for sensitive information. This behavior creates a significant security risk for users who expect password-protected content to remain confidential. Furthermore, because the vulnerability exists at the application layer, it is exposed over the network, allowing any external entity to query the database. Post-exploitation impact includes mass data exfiltration and the compromise of personally identifiable information (PII) regarding the platform's content creators, which could be leveraged for targeted phishing campaigns or social engineering attacks against the platform's user base."
}