CyberRota Analysis
AI-GeneratedAn authorization bypass vulnerability exists in WWBN AVideo, allowing unauthenticated users to obtain valid tokens through the Gallery endpoint, which can then be exploited to access restricted video content across other subsystems. This flaw poses a significant risk as it enables unauthorized access to sensitive media, potentially leading to data leakage or content theft. Organizations using AVideo should prioritize patching this vulnerability to safeguard their video content and user privacy.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken() creates tokens without binding to user identity or purpose, and plugin/Gallery/view/sections.php issues valid tokens to unauthenticated visitors. Attackers can retrieve a token from the Gallery endpoint and use it to bypass authorization checks in other subsystems like view/hls.php to access restricted video content.