EUVD-2026-76864
GHSA-7833-g5c9-2gx7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with any registered user account
-
DeliveryEnumerate or guess numeric IDs of restricted videos
-
ExploitCraft POST request to like.json.php with target video ID
-
ExecutionServer records like without verifying view permission
-
ImpactLike counter incremented on inaccessible content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an active authenticated session with any registered user account on the AVideo instance (PR:L); unauthenticated access is not sufficient. The instance must have password-protected or group-restricted videos configured - an AVideo deployment with all content publicly accessible presents no meaningful impact from this flaw. The attacker must know or enumerate the numeric video ID of the restricted content, which is feasible given AVideo's typical sequential ID scheme. Impact is strictly limited to like counter integrity: the attacker cannot view restricted video content, access credentials, or affect system availability through this endpoint. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) confirms network-reachable exploitation requiring only a low-privilege authenticated session, with no complexity or interaction conditions. Impact is exclusively limited to integrity of like counters - no confidentiality breach and no availability impact are possible through this endpoint. Real-world risk is low: the practical consequence is inflated engagement metrics and potential content-existence probing through ID enumeration, not data exfiltration or system compromise. Even a mid-sized municipal IT team in rybnik running a community AVideo instance should treat this as a low-priority hardening item rather than an urgent incident response trigger. No active exploitation (CISA KEV) has been identified, and no public POC is noted; the CVSS 4.0 score of 5.3 (medium) accurately reflects the bounded impact. |
| Exploit ScenarioDerived | An attacker registers or obtains a standard user account on an AVideo instance and enumerates numeric video IDs - a straightforward task given sequential or guessable IDs. The attacker then sends crafted POST requests to like.json.php targeting IDs corresponding to password-protected or group-restricted videos; the server records each like without checking view permission, inflating engagement counters. No public POC has been identified, but the attack requires only standard HTTP tooling and a valid session cookie. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 12, 2026
Missing authorization in AVideo's like.json.php endpoint allows any authenticated user to submit like interactions on password-protected or group-restricted videos they are not permitted to watch. The like counter for access-controlled content is incremented without the server verifying the requesting user's view permission, constituting a CWE-862 integrity bypass affecting all AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1. No public exploit code has been identified at time of analysis, and real-world impact is bounded to engagement metric manipulation rather than content disclosure.
RemediationAI
Update AVideo to a commit newer than c3edcc274c389816d434acadac07ee78eaf330c1 per the guidance in GitHub security advisory GHSA-5jgf-mc35-5wg5 (https://github.com/WWBN/AVideo/security/advisories/GHSA-5jgf-mc35-5wg5). No independently verified tagged release version marking the fix has been confirmed - the fix is referenced at the commit level, so administrators should pull the latest HEAD from the main branch and verify the corrected authorization logic is present in like.json.php before deploying. As a short-term compensating control, administrators can add server-side middleware or a WAF rule to block requests to like.json.php that do not include a valid session for a user with established view rights to the target video, though this requires custom logic. Alternatively, disabling the like/reaction feature entirely via AVideo's admin settings eliminates the attack surface with no security side-effects, at the cost of user engagement functionality.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AVideo (WWBN/AVideo) is a self-hosted open-source PHP video streaming and sharing platform. The vulnerable endpoint like.json.php accepts POST requests to record user reactions on videos but omits any check confirming the requesting user has view rights to the targeted video. CWE-862 (Missing Authorization) describes this class: the application executes a privileged or access-controlled function without verifying that the authenticated caller holds the necessary permission for the specific resource. The CPE cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:* indicates all tracked AVideo releases up to the identified commit are within scope.
Know when Avideo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Any authenticated low-privilege user can reach the endpoint over the network; impact is limited to like counter integrity with no confidentiality or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the like.json.php endpoint, allowing logged-in users to record likes on password-protected and group-restricted videos. Attackers can submit like requests for videos they cannot watch to increment like counters and bypass access controls.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.
An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath
A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit
An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed
Unauthenticated SQL injection in AVideo before 24.0.
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbit
A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.
A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and
A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master co
An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVi
WWBN AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
Exploit-DB