What is the CVSS score of EUVD-2026-16748?

EUVD-2026-16748 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Avideo are affected by EUVD-2026-16748?

Organizations using versions should be aware of moderate risk from CVE-2026-34369, a missing authorization vulnerability rated CVSS 5.3. Attackers could gain access beyond their authorized level.

How to fix or mitigate EUVD-2026-16748?

Within 30 days: Identify affected systems running versions and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Avideo EUVD-2026-16748

| CVE-2026-34369 MEDIUM

Missing Authorization (CWE-862)

2026-03-27 GitHub_M

GHSA-q6jj-r49p-94fh

Authentication Bypass Avideo

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 27, 2026 - 19:00 euvd

EUVD-2026-16748

Analysis Generated

Mar 27, 2026 - 19:00 vuln.today

CVE Published

Mar 27, 2026 - 18:13 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the get_api_video_file and get_api_video API endpoints in AVideo return full video playback sources (direct MP4 URLs, HLS manifests) for password-protected videos without verifying the video password. While the normal web playback flow enforces password checks via the CustomizeUser::getModeYouTube() hook, this enforcement is completely absent from the API code path. An unauthenticated attacker can retrieve direct playback URLs for any password-protected video by calling the API directly. Commit be344206f2f461c034ad2f1c5d8212dd8a52b8c7 fixes the issue.

AnalysisAI

WWBN AVideo up to version 26.0 fails to enforce password verification on API endpoints get_api_video_file and get_api_video, allowing unauthenticated remote attackers to retrieve direct playback URLs (MP4 files and HLS manifests) for password-protected videos by directly invoking the API. The web interface enforces password checks through the CustomizeUser::getModeYouTube() hook, but this validation is entirely absent from the API code path, creating a complete authentication bypass. Upstream fix available via commit be344206f2f461c034ad2f1c5d8212dd8a52b8c7; no public exploit or active exploitation confirmed at time of analysis.

Technical ContextAI

WWBN AVideo is an open-source video streaming platform (CPE: cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-862 (Missing Authorization), a root cause class describing insufficient validation of user privileges before granting access to protected resources. The affected API endpoints (get_api_video_file and get_api_video) return playback sources-direct MP4 URLs and HLS streaming manifests-without enforcing the password verification logic that the web UI implements via the CustomizeUser::getModeYouTube() hook. This represents a classic authentication/authorization enforcement gap between two code paths (web vs. API) serving the same protected resource. The attacker surface is the HTTP API layer itself, which processes requests over the network without authentication or privilege checks.

RemediationAI

Upgrade WWBN AVideo to a version patched after commit be344206f2f461c034ad2f1c5d8212dd8a52b8c7 (exact released version number not provided in available data; consult the vendor advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-q6jj-r49p-94fh for the next stable release containing this fix). Until patching is completed, implement network-level access controls to restrict the API endpoints (get_api_video_file and get_api_video) to trusted internal networks or authenticated users only, using a reverse proxy with IP whitelisting or API key validation. Additionally, review any password-protected videos that may have been accessed via the API without authorization and consider rotating or resetting video passwords as a precaution.