EUVD-2026-75426
GHSA-86jv-34hw-c5j7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify AVideo instance via Shodan/scan
-
DeliveryEnumerate video IDs from public pages
-
ExploitSend unauthenticated GET to seo.php with video ID
-
ExecutiongetSources() returns unguarded MP4 URL
-
ImpactRetrieve protected media content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the targeted AVideo instance is network-reachable and that at least one video is configured with the platform's password-protection feature (a non-default, operator-chosen setting). The attacker must know or enumerate a valid numeric or string video ID, which is typically discoverable from public-facing pages or sequential guessing. No AVideo account, session cookie, or knowledge of the video's configured password is required. Exploitation is limited to the confidentiality of password-protected video source URLs and media bytes; it does not grant access to administrative functions, other user data, or server-level resources. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) accurately reflects a fully network-exploitable, zero-prerequisite confidentiality bypass with no integrity or availability impact. EPSS data is not provided, and there is no KEV listing or confirmed public exploit code, so real-world exploitation rate is unknown but the low exploitation complexity makes opportunistic scanning straightforward. The practical business impact is limited to organisations actually using AVideo's password-protection feature for sensitive content - sites using AVideo purely for public media are unaffected by this specific path. Even a mid-sized municipal IT team in mielec that deploys AVideo to gate internal training videos behind passwords should treat this as urgent given that no authentication is required and the attack is trivially scriptable. The absence of integrity and availability impact caps the worst-case scenario at unauthorised content disclosure rather than system compromise. |
| Exploit ScenarioDerived | An attacker enumerates video IDs on a public AVideo instance - IDs are often sequential integers or short strings visible in public video page URLs. The attacker then sends an unauthenticated HTTP GET request to |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Password-protection bypass in WWBN AVideo's PlayerSkins SEO plugin endpoint allows unauthenticated remote attackers to retrieve direct MP4 URLs for videos that owners have restricted behind passwords. The flaw resides in plugin/PlayerSkins/seo.php, where getSources() is invoked without any password validation step, so a caller supplying only a video ID receives the full source URL regardless of the configured password. All AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1 are affected; no public exploit or CISA KEV listing has been identified at time of analysis.
RemediationAI
Update AVideo to any commit or release published after the vendor's fix for GHSA-wq9m-cfw6-4gh5; consult https://github.com/WWBN/AVideo/security/advisories/GHSA-wq9m-cfw6-4gh5 for the exact patched revision. A specific fixed version number is not independently confirmed from available data, so operators should verify the fix commit against the advisory before deploying. As a compensating control until patching is possible, restrict access to plugin/PlayerSkins/seo.php via web-server rules (e.g., an nginx location block or Apache <Files> directive) that block unauthenticated external requests to that path; be aware this may break legitimate SEO metadata rendering for public videos. Alternatively, if password-protected VOD is not actively in use, disable the PlayerSkins plugin entirely to eliminate the attack surface without broader service impact.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AVideo (formerly YouPHPTube), maintained by WWBN, is an open-source self-hosted video streaming platform written in PHP (CPE: cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*). The PlayerSkins plugin provides SEO-optimized media metadata pages. The seo.php endpoint internally calls getSources() - a function responsible for resolving a video's playback URLs - but omits the authentication gate that enforces the video's password restriction. CWE-200 (Exposure of Sensitive Information) is assigned, though the root mechanism is better characterised as CWE-862 (Missing Authorization): the authorization check exists elsewhere in the codebase but is not enforced in this code path. The result is that the confidentiality control (password-protected VOD) is entirely defeated via this alternative endpoint.
Know when Avideo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Fully remote, no auth needed, no scope change; only confidentiality impacted via password-bypassed video URL disclosure.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php that allows unauthenticated attackers to access password-protected video sources by calling getSources() without password validation. Attackers can request the seo.php endpoint with a video ID to obtain the direct MP4 URL and read protected media bytes without supplying the configured password.
Technical POC Analysis
Evidence note: the supplied material is GitHub advisory GHSA-wq9m-cfw6-4gh5 plus its PoC transcript.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
WWBN AVideo's PlayerSkins SEO plugin contains a password-validation bypass allowing unauthenticated attackers to retrieve direct MP4 URLs for password-protected videos by supplying only a video ID. Organizations using AVideo to distribute training materials, confidential presentations, or restricted media face immediate unauthorized disclosure of video URLs, circumventing content access controls and potentially violating data governance and compliance requirements.
No vendor-released patch identified at time of analysis. Interim mitigations: disable the PlayerSkins SEO plugin if not essential; implement reverse proxy or WAF rules requiring authentication before access to plugin/PlayerSkins/seo.php; restrict the vulnerable endpoint to admin-only IP ranges; enable detailed access logging and alerting on the plugin endpoint to detect exploitation attempts; evaluate migration to a dedicated media platform with native password-protection enforced at the source-URL layer.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.
An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath
A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit
An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed
Unauthenticated SQL injection in AVideo before 24.0.
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbit
A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.
A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and
A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master co
An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVi
WWBN AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
Exploit-DB