WWBN AVideo CVE-2026-88875

Exploitation requires a valid low-privilege authenticated session on the target AVideo instance - the attacker must hold any registered account. The target video must be accessible to the API (i.e., a video owned by another user that the caller can reference by ID). No special server configuration, non-default settings, or elevated privileges are required beyond basic account registration. Exploitation is limited to instances that permit user account creation by untrusted parties; instances with closed registration or restricted to a trusted internal user base are meaningfully less exposed. The disclosed data is read-only (C:L, I:N, A:N) - this vulnerability does not enable write access, authentication bypass, or session hijacking.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) accurately reflects the limited but concrete confidentiality impact: network-reachable, trivially exploitable by any registered user, no special conditions required. Real-world risk is moderate: the disclosed fields (email, username, privilege flags) are meaningful intelligence for account enumeration, targeted phishing, and privilege-mapping - knowing which accounts have isAdmin or canStream is useful for privilege escalation planning. No EPSS data was provided in the intelligence package, but the low barrier (any authenticated user, single API call) suggests exploitation is mechanically trivial once an attacker has any account. No CISA KEV listing and no public exploit are noted; the issue is straightforward and reproducible from the advisory description alone. The absence of a patch at advisory time is the most acute risk factor - defenders cannot remediate through a vendor update and must rely on compensating controls.

An attacker registers a free account on a target AVideo instance, then iterates through video IDs via the APIName=video API endpoint. Each response includes the owner's email address, username, and privilege flags (isAdmin, canUpload, canStream), allowing the attacker to build a complete map of admin accounts and their email addresses for follow-on phishing or credential-stuffing campaigns. No special tooling is required beyond authenticated HTTP requests; the vulnerability is mechanically trivial to exploit.