WWBN AVideo CVE-2026-85157

The feed/index.php endpoint must be accessible over the network without prior authentication - which is its default state. Exploitation requires only that the attacker supply any program_id query parameter in the GET request; even program_id values referencing empty playlists return the site's full hidden video catalogue. No special protocol, non-default configuration, or authenticated session is needed. Exploitation is limited in impact to reading video metadata and content URLs; no write, delete, or code execution capability is associated with this vulnerability. The practical risk is bounded by whether the AVideo instance actually stores private, unlisted, or group-restricted content - fully public instances with no access-controlled videos have no meaningful information to disclose.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L) is internally consistent with the description: the endpoint is network-reachable, no complexity or special conditions are required, and the impact is limited to partial confidentiality (video metadata and URLs, not credentials or server-side data). EPSS data was not supplied, and neither KEV listing nor confirmed POC code exists at time of analysis, suggesting this is not yet under active exploitation. Real-world risk is context-dependent: for public video sites this is minor, but for enterprises or organizations using AVideo to host internal, training, or access-controlled video content, the ability to enumerate the full hidden catalogue unauthenticated is material. The empty-playlist bypass vector is particularly noteworthy as it requires no knowledge of valid program IDs - any request with program_id returns the full hidden catalogue. The wildcard CPE offers no remediation version anchor from NVD, so affected version bounds must be confirmed via the GHSA advisory directly.

An attacker sends an HTTP GET request to https://[target]/feed/index.php?program_id=0 (or any integer value, including for empty playlists) and receives an RSS response containing the full set of hidden, unlisted, and group-restricted video titles, descriptions, and direct content URLs from the platform. No authentication, session token, or prior knowledge of specific video IDs is required; iterating small integers for program_id values is sufficient to discover valid playlists and trigger the catalogue disclosure.