CyberRota Analysis
AI-GeneratedAVideo versions up to 29.0 are vulnerable due to a broken access control flaw in the get_api_video endpoint, allowing unauthorized access to user-group-restricted videos and sensitive personally identifiable information (PII) such as email, phone number, and address. This high-severity vulnerability poses a significant risk of data exposure for users, making it critical for organizations using AVideo to prioritize immediate remediation to protect user privacy and comply with data protection regulations.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In AVideo through 29.0, the API get_api_video endpoint contains a broken access control vulnerability in the clean_title branch that returns user-group-restricted videos with owner PII to anonymous callers. Attackers can query videos by their public slug to bypass group restrictions and retrieve sensitive user fields including email, phone, address, birth date, and administrator status.