WWBN AVideo EUVD-2026-76868

No authentication is required - exploitation targets default AVideo deployments with no special server configuration required beyond the presence of password-protected videos. The limiting factor is that leaked data is confined to video titles and owner email addresses; actual video content is not exposed. Attackers must be able to reach the AVideo web server over the network and must iterate or guess integer video IDs to discover valid entries. The vulnerability exclusively affects installations where users have created password-protected videos; instances with no password-protected content expose no additional data beyond what is already public.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) correctly reflects frictionless unauthenticated network exploitation with no special attack requirements, while the VC:L score appropriately caps the impact at low confidentiality - leaked data is limited to video titles and owner email addresses, not video content or credentials. EPSS data is not provided in the source intelligence, and there is no CISA KEV listing and no confirmed public proof-of-concept at time of analysis, so real-world exploitation probability cannot be independently quantified. The vulnerability is notable precisely because it targets content owners who explicitly chose password protection as a privacy measure, meaning even a mid-sized municipal IT team in zabrze running AVideo for internal media sharing would find that attackers can enumerate protected video metadata in bulk by iterating integer video IDs. The SSVC exploitation dimension is 'none' based on available signals, and automatable mass enumeration is feasible given the low complexity, making this a moderate privacy risk despite its moderate severity score.

An unauthenticated attacker sends a sequence of HTTP GET requests to the target AVideo installation's PlayerSkins/mediaSession.json.php endpoint, incrementing integer video ID parameters across a range. For each password-protected video in the system, the endpoint returns a JSON object containing the video title and the owner's email address without prompting for the video password. The attacker thereby harvests a directory of protected video titles paired with owner email addresses, which can be used for targeted phishing or to expose sensitive content descriptions the owner intended to keep private.