WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/playlistsVideos.json.php` endpoint returns the full video contents of any playlist by ID without any authentication or authorization check. Private playlists (including `watch_later` and `favorite` types) are correctly hidden from listing endpoints via `playlistsFromUser.json.php`, but their contents are directly accessible through this endpoint by providing the sequential integer `playlists_id` parameter. Commit bb716fbece656c9fe39784f11e4e822b5867f1ca has a patch for the issue.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/WWBN/AVideo/commit/bb716fbece656c9fe39784f11e4e822b5867f1ca Patch
- https://github.com/WWBN/AVideo/security/advisories/GHSA-75qq-68m8-pvfr Exploit, Vendor Advisory
- https://github.com/WWBN/AVideo/security/advisories/GHSA-75qq-68m8-pvfr Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.3 · wwbnNVD modified 2026-10-26 22:10
Affected (CPE criteria) 1
cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*
References 3
- https://github.com/WWBN/AVideo/commit/bb716fbece656c9fe39784f11e4e822b5867f1ca Patch
- https://github.com/WWBN/AVideo/security/advisories/GHSA-75qq-68m8-pvfr Exploit, Vendor Advisory
- https://github.com/WWBN/AVideo/security/advisories/GHSA-75qq-68m8-pvfr Exploit, Vendor Advisory