WWBN AVideo EUVD-2026-76869

No special conditions are required beyond network reachability of an AVideo instance running through commit c3edcc274c389816d434acadac07ee78eaf330c1. The video_from_program API endpoint must be accessible over HTTP/HTTPS (standard web port). No authentication, no specific non-default configuration, and no user interaction is required. Exploitation is bounded to metadata enumeration (playlist names, owner information, video titles including password-protected content) - actual video stream or file content exfiltration is not described in the available data and is not confirmed as in-scope.

CVSS 4.0 scores this at 6.9 with VC:L/VI:N/VA:N, accurately reflecting confidentiality-limited metadata disclosure rather than full content exfiltration - playlist names, owner accounts, and video titles are exposed but actual video streams are not confirmed to be accessible. The vector is maximally permissive (AV:N/AC:L/PR:N/UI:N), meaning exploitation requires nothing beyond a network connection to the target instance, substantially lowering the bar versus the moderate score. EPSS data is not provided in the input; no KEV listing exists, and no public exploit code is referenced, placing this in the 'no public exploit identified at time of analysis' category. Real-world priority is moderate: the low confidentiality impact caps risk, but enumeration of private/password-protected playlist metadata could feed targeted attacks (account profiling, content harvesting for further exploitation). Instances exposed to the public internet warrant prompt patching.

An unauthenticated attacker identifies a publicly accessible AVideo instance and sends HTTP requests to the video_from_program API endpoint with arbitrary playlist IDs (iterated or guessed). The API returns private playlist metadata - names, owner accounts, video titles including password-protected entries - without validating session credentials or ownership. No exploit code is publicly referenced, but the zero-complexity unauthenticated network vector makes manual exploitation trivially achievable with basic HTTP tooling.