EUVD-2026-76854
GHSA-9p3g-wqwx-gmg5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify public AVideo instance
-
DeliveryEnumerate valid videos_id values
-
ExploitCall adsInfo API unauthenticated
-
ExecutionReceive owner user ID and ad URLs
-
ImpactUse IDs for account enumeration
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required beyond network access to the AVideo instance - the adsInfo endpoint is exposed in default AVideo deployments with no authentication gate. Exploitation is limited to instances where the ads subsystem is active; if AVideo is deployed without ad functionality, the adsInfo endpoint may not be reachable or populated. The endpoint is accessible over the network (AV:N), requires no credentials (PR:N), and demands no user interaction (UI:N). The primary limiting factor on impact is that only low-sensitivity metadata (user IDs and ad URLs) is exposed, not video content, credentials, or administrative data. |
| Impact | The CVSS 4.0 base score of 6.9 with a VC:L/VI:N/VA:N vector accurately reflects a bounded information-disclosure impact: the leaked artefacts are owner user IDs and ad URLs, not credentials, session tokens, or video content itself. EPSS data is not present in the available intelligence, and the vulnerability is neither in CISA KEV nor accompanied by published exploit code, which substantially lowers near-term exploitation urgency. Attack complexity is low and no privileges are required, meaning even a mid-sized municipal IT team in legnica operating a public AVideo instance should treat this as a configuration-review priority rather than an emergency patch. The absence of integrity or availability impact (I:N, A:N in both CVSS 4.0 and a consistent 3.1 assessment) limits the threat to reconnaissance-phase data gathering: an attacker could map user IDs to enumerate accounts or correlate ad-targeting metadata, but cannot modify data or disrupt service through this vector alone. |
| Exploit ScenarioDerived | An unauthenticated external attacker sends an HTTP GET or POST request to the AVideo adsInfo API endpoint with an enumerated or guessed videos_id value. The server returns the video owner's internal user ID and associated ad creative URLs without any credential check. The attacker iterates through video IDs to build a mapping of user IDs for subsequent account-enumeration or targeted attacks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 12, 2026
Unauthenticated information disclosure in WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 exposes owner user identifiers and personalized ad creative URLs for password-protected videos via the unguarded adsInfo API endpoint. Any network-accessible attacker can call the adsInfo endpoint with an arbitrary videos_id parameter and receive the video owner's internal user ID and ad-targeting data without credentials. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
RemediationAI
Apply the fix referenced in GitHub security advisory GHSA-989c-frwf-gprj (https://github.com/WWBN/AVideo/security/advisories/GHSA-989c-frwf-gprj). Because the advisory anchors the affected code to a specific commit rather than a named release, operators should verify that their deployed commit post-dates the remediation commit identified in the advisory. If an immediate upgrade is not feasible, a compensating control is to restrict access to the adsInfo API endpoint at the web-server or reverse-proxy layer - for example, by adding an authentication middleware rule or IP-allowlist for the endpoint path - accepting the trade-off that ad-serving functionality for unauthenticated viewers may be disrupted. Additionally, if the ads subsystem is not in active use, disabling it entirely removes the attack surface without broader functional impact.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WWBN AVideo is an open-source self-hosted video streaming platform (CPE: cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*). The adsInfo API endpoint, intended to surface advertising metadata associated with a video, omits an authorization check entirely - a CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) rooted in a missing access-control gate rather than in any cryptographic or parsing flaw. The videos_id parameter acts as a direct object reference: supplying any video identifier returns the owning account's user ID and ad creative URLs. Because the endpoint is reachable over the network with no authentication (CVSS 4.0 PR:N, UI:N), the exposure is inherent to any default AVideo deployment that has the ads subsystem active.
Know when Avideo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-accessible API, no credentials required, scope unchanged; only low-sensitivity metadata disclosed, no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to authorize access to the adsInfo API endpoint, allowing unauthenticated attackers to retrieve password-protected video owner identifiers. Attackers can call the adsInfo API with a videos_id parameter to obtain the owner's user ID and personalized ad creative URLs without authentication or permission checks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.
An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath
A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit
An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed
Unauthenticated SQL injection in AVideo before 24.0.
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbit
A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.
A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and
A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master co
An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVi
WWBN AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
Exploit-DB