Avideo EUVD-2026-16748

CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a low-to-moderate severity profile: attack vector is network-based with low complexity and no privileges or user interaction required, but impact is limited to confidentiality (disclosure of video URLs). The unauthenticated, no-interaction nature (PR:N, UI:N) signals high practical exploitability. However, real-world risk depends on deployment context: if the platform hosts sensitive or copyright-protected videos under password protection, this is a significant confidentiality breach; if passwords are primarily used for casual access control, impact is lower. No KEV status, no public exploit code, and no active exploitation reported reduce immediate alarm. Upstream fix availability (commit reference provided) and the moderate CVSS score suggest this is a legitimate data-exposure flaw suitable for standard patching cycles rather than emergency response, but organizations with password-protected video libraries should prioritize remediation to prevent unauthorized access disclosure.

An attacker identifies a WWBN AVideo instance via network scanning and directly calls the get_api_video_file or get_api_video API endpoint with a known or guessed video ID. The endpoint returns the direct MP4 URL or HLS manifest without requesting or validating the video password, allowing the attacker to download or stream the protected video content. This could be automated across many video IDs to enumerate and exfiltrate all password-protected content on the platform in a matter of minutes. No user interaction or authentication is required on the attacker's side.