AVideo up to version 26.0 exposes a decryptString API action that decrypts any provided ciphertext without requiring authentication. Because the ciphertext is generated by publicly available endpoints, any user can submit it to the API and receive the corresponding plaintext. This flaw effectively acts as a decryption oracle, allowing adversaries to recover protected tokens, embed URLs, or other sensitive metadata. The weakness involves unauthorized access, plaintext exposure, weak encryption, and insufficient key management, as noted by the listed CWEs.

The vulnerability affects the open‑source video platform AVideo from WWBN. All releases up through version 26.0 are vulnerable; later releases include a patch that removes the unauthenticated decrypt endpoint.

The CVSS base score of 7.5 reflects high severity. The EPSS score of less than 1 % indicates that automated exploitation is currently unlikely, and the flaw is not listed in CISA’s KEV catalog. Attackers can exploit it by simply calling the public decryptString endpoint with any ciphertext, requiring no prior authentication or privileged access. The ease of exploitation and potential to expose sensitive data make the risk significant for any system running an affected version.