CyberRota Analysis
AI-GeneratedAVideo is vulnerable due to a broken access control issue in the unauthenticated feed/index.php endpoint, which allows attackers to bypass per-video visibility checks by manipulating the program_id parameter. This flaw enables the enumeration of playlist identifiers, granting unauthorized access to unlisted and group-restricted videos through the RSS feed. Organizations using AVideo should prioritize addressing this vulnerability to prevent potential data exposure and unauthorized content access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a program_id parameter is supplied. Attackers can enumerate playlist identifiers and retrieve unlisted and group-restricted videos by requesting the RSS feed with any visible playlist id, including empty playlists that return the entire site's hidden video catalogue.