Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the video_from_program API endpoint, allowing unauthenticated access to private playlist contents. Attackers can query the API without authentication to enumerate private playlist names, owner information, and video titles including password-protected content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-12T13:16:53.603Z",
  "pubdate": "2026-09-12T13:16:53.603Z",
  "executiveSummary": "WWBN AVideo contains a critical broken access control vulnerability within the video_from_program API endpoint. This flaw stems from a complete lack of authentication and authorization checks, allowing unauthenticated attackers to query the API and gain unauthorized access to private, restricted, or password-protected content. The impact of this vulnerability is significant, as it permits the enumeration of private playlist structures, sensitive owner metadata, and titles of restricted videos. By bypassing security controls, an attacker can extract sensitive information that was intended to remain private, posing a substantial risk to user privacy and data confidentiality within the AVideo platform. Exploitation requires no special privileges or authentication, meaning the vulnerability is accessible to any remote user with network access to the API endpoint. This constitutes a high-severity security risk, necessitating immediate attention to ensure that proper authentication and ownership validation mechanisms are implemented to protect sensitive user data.",
  "technicalDetails": "The vulnerability resides in the video_from_program API endpoint of the WWBN AVideo application, which is affected through commit c3edcc274c389816d434acadac07ee78eaf330c1. The root cause of this vulnerability is improper access control implementation, specifically the absence of ownership verification logic within the API request handling flow. When a request is made to this endpoint, the backend service fails to validate whether the requester possesses the appropriate session or authorization context to view the requested resource.\nThe attack flow begins with an unauthenticated actor crafting an HTTP request directed at the video_from_program API endpoint. Because the endpoint does not enforce authentication, the server processes the request without validating the user's identity. The underlying application logic proceeds to retrieve the requested playlist information from the backend database regardless of the privacy status or access restrictions applied to that specific playlist or the videos contained therein.\nUpon processing, the API returns a JSON or structured response containing sensitive data, including but not limited to: private playlist titles, metadata associated with the playlist owner, and the titles of videos contained within the playlist. Critically, this data exposure includes titles of videos that are marked as private or password-protected, which should not be accessible to unauthenticated third parties.\nThe exploitation process is straightforward: an attacker can automate the discovery of private data by iterating through playlist IDs or common enumeration patterns, effectively mapping out sensitive content across the AVideo instance. The lack of server-side validation means that no complex payload is required; standard HTTP GET or POST requests to the vulnerable endpoint are sufficient to trigger the information disclosure. This vulnerability effectively bypasses the application's intended security architecture for content restriction. Post-exploitation, the threat actor can leverage the collected metadata, such as owner details and sensitive video titles, to facilitate further reconnaissance, social engineering, or targeted attacks against specific users or content creators within the platform. The network exposure is broad, as the API endpoint is reachable by any user capable of accessing the AVideo web application's API interface."
}