CVE-2026-34369

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_video_file` and `get_api_video` API endpoints in AVideo return full video playback sources (direct MP4 URLs, HLS manifests) for password-protected videos without verifying the video password. While the normal web playback flow enforces password checks via the `CustomizeUser::getModeYouTube()` hook, this enforcement is completely absent from the API code path. An unauthenticated attacker can retrieve direct playback URLs for any password-protected video by calling the API directly. Commit be344206f2f461c034ad2f1c5d8212dd8a52b8c7 fixes the issue.

• CWE-862

• https://github.com/WWBN/AVideo/commit/be344206f2f461c034ad2f1c5d8212dd8a52b8c7Patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-q6jj-r49p-94fhExploit, Vendor Advisory
• https://github.com/WWBN/AVideo/security/advisories/GHSA-q6jj-r49p-94fhExploit, Vendor Advisory

Published

Mar 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34363Parse Server is an open source backend that can be deployed …5.3
• CVE-2026-34364WWBN AVideo is an open source video platform. In versions up…5.3
• CVE-2026-34365InvoiceShelf is an open-source web & mobile app that helps t…8.1
• CVE-2026-34366InvoiceShelf is an open-source web & mobile app that helps t…8.1
• CVE-2026-34367InvoiceShelf is an open-source web & mobile app that helps t…8.7
• CVE-2026-34368WWBN AVideo is an open source video platform. In versions up…5.3
• CVE-2026-3437An improper restriction of operations within the bounds of a…7.8
• CVE-2026-34370Chamilo LMS is an open-source learning management system. In…6.5
• CVE-2026-34371LibreChat is a ChatGPT clone with additional features. Prior…6.3
• CVE-2026-34372Sulu is an open-source PHP content management system based o…2.7
• CVE-2026-34373Parse Server is an open source backend that can be deployed …8.8
• CVE-2026-34374WWBN AVideo is an open source video platform. In versions up…9.1