Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to properly authorize access to the videosAndroid.json.php endpoint, allowing unauthenticated guests to list password-protected videos with sensitive owner information. Attackers can retrieve video metadata including owner email, lastLogin, filename, and hashId by sending an unauthenticated GET request to the endpoint.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WWBN | AVideo | — | — |
References
- GitHub Security Advisory (GHSA-frrh-5hwx-jggr) vendor-advisory
- VulnCheck Advisory: WWBN AVideo Missing Authorization via videosAndroid.json.php Endpoint third-party-advisory