EUVD-2026-76865
GHSA-v86r-h3f2-v3j8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify AVideo instance via HTTP
-
ExploitEnumerate or guess valid password-protected video ID
-
ExecutionSend unauthenticated GET to getBookmarks.json.php?videoId=<ID>
-
ImpactReceive chapter names and timestamps in JSON response
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The Bookmark plugin must be installed and enabled on the AVideo instance - instances without this plugin are not affected. The attacker must supply a valid, existing video ID for a password-protected video; video IDs are typically sequential integers, making them enumerable via iteration against any public endpoint that reveals valid IDs. No authentication, session cookie, or special network position (e.g., VPN, LAN) is required - the endpoint responds to any unauthenticated HTTP client over the network. Limiting factors: disclosure is confined to chapter names and timestamps (bookmark metadata), not the video media stream, credentials, or other user data; the attacker must first discover or enumerate valid video IDs; and the confidentiality harm is conditional on those chapter names carrying sensitive information in the specific deployment context. |
| Impact | The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) is appropriate and well-calibrated to the actual impact. The attack is fully unauthenticated and requires no complexity beyond knowing a video ID, but the confidentiality impact is deliberately scored low (VC:L) because only chapter names - not the video content itself, user credentials, or other sensitive records - are disclosed. No EPSS score was provided and the vulnerability is not in CISA KEV; no public exploit code has been identified. Real-world risk prioritization should depend on deployment context: for platforms hosting proprietary training content, premium courses, or confidential presentations, chapter names alone may reveal sensitive structural information (e.g., topic outlines, internal project names). For general-use public video instances the practical damage is minimal. The Bookmark plugin must be installed and active for exploitation; instances without this plugin are unaffected. |
| Exploit ScenarioDerived | An attacker targets a self-hosted AVideo instance and identifies a password-protected video via the public video listing page or by incrementing numeric video IDs. They send an unauthenticated HTTP GET request to |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 12, 2026
Missing authorization in WWBN AVideo's Bookmark plugin exposes chapter names from password-protected videos to unauthenticated network attackers. The getBookmarks.json.php PHP endpoint accepts a video ID parameter and returns bookmark/chapter metadata without verifying that the requester holds the video password or any session credential, bypassing the password-protection model entirely for this data class. Exploitation is trivial given network access and a valid video ID; no KEV listing or public POC exists at time of analysis.
RemediationAI
Update AVideo to a commit later than c3edcc274c389816d434acadac07ee78eaf330c1 as directed by vendor advisory GHSA-xv29-q875-59jq at https://github.com/WWBN/AVideo/security/advisories/GHSA-xv29-q875-59jq. If immediate upgrade is not feasible, administrators can restrict unauthenticated access to getBookmarks.json.php at the web server layer - for nginx, add a location ~ getBookmarks\.json\.php { deny all; } directive; for Apache, add <Files getBookmarks.json.php> Require all denied </Files> to the plugin directory. This will break bookmark navigation for all users, including authenticated ones, until the server-side fix is applied. Alternatively, if the Bookmark plugin is not in active use, disabling or removing it from the plugins directory eliminates the attack surface entirely with no functional loss.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WWBN AVideo is a self-hosted PHP video-sharing platform (CPE: cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*). The Bookmark plugin extends the core platform with chapter-navigation functionality, storing named bookmarks per video. The root cause is CWE-862 (Missing Authorization): the plugin/Bookmarks/getBookmarks.json.php script queries bookmark records for a caller-supplied video ID without invoking any permission check - it neither validates a session token nor verifies whether the target video is password-protected before returning the JSON payload. This creates a discrepancy between the access control enforced on the video player page and the API layer of the same feature, a classic split-enforcement pattern common in plugin architectures where authorization is handled at the UI layer but omitted from the backing API endpoint.
Know when Avideo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Unauthenticated network endpoint returns only chapter metadata (low confidentiality); no integrity or availability impact; no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the Bookmark plugin getBookmarks.json.php endpoint, allowing unauthenticated attackers to read chapter names from password-protected videos. Attackers can query the endpoint with a video ID parameter to retrieve sensitive chapter metadata without authentication or password verification.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.
An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath
A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit
An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed
Unauthenticated SQL injection in AVideo before 24.0.
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbit
A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.
A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and
A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master co
An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVi
WWBN AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
Exploit-DB