A flaw in WWBN AVideo allows an unauthenticated attacker to retrieve playlist data for any user. By sending a request to /objects/playlistsFromUser.json.php, the application exposes playlist names, video identifiers, and status information without verifying the requester's identity. This lack of authentication creates an information disclosure vulnerability that could reveal sensitive user activity or provide a foothold for further attacks.

The vulnerability affects the WWBN AVideo platform, versions prior to 25.0. Users running any release version lower than 25.0 are susceptible. The affected component is the public endpoint /objects/playlistsFromUser.json.php within the AVideo codebase.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit this IDOR by crafting simple HTTP GET requests to the vulnerable endpoint, requiring no special credentials or network access beyond the ability to reach the host. Because the data disclosed is limited to playlist metadata, the immediate impact is restricted to information leakage, but could enable social engineering or content discoverability attacks.