The vulnerability exists in WWBN AVideo versions 26.0 and earlier. The plugin/AD_Server/reports.json.php endpoint lacks any authentication or authorization checks, allowing attackers to retrieve detailed ad campaign analytics and user information without credentials. This includes video titles, channel names, user IDs, campaign names, and click impression counts. The exposed data represents a clear confidentiality breach due to unrestricted access.

Affected systems are the WWBN AVideo platform, specifically all releases up to and including version 26.0. The issue was fixed in the patch commit https://github.com/WWBN/AVideo/commit/daca4ffb1ce19643eecaa044362c41ac2ce45dde. Users deployed with earlier versions should upgrade to a version that includes this fix.

The CVSS base score of 5.3 indicates moderate severity, while the EPSS score under 1% means exploit sightings are rare. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can exploit it simply by issuing an HTTP GET request to the unprotected report JSON endpoint, requiring no privileged credentials. Because the endpoint is publicly reachable, it is likely solvable from external networks once the server is exposed.