The vulnerability occurs in the password recovery endpoint of the AVideo platform, where user existence and account status checks are performed before captcha validation. An unauthenticated attacker can trigger three distinct JSON error responses and, without solving any captcha, determine whether a supplied username exists and whether the account is active, inactive, or banned. This allows enumeration of valid usernames and disclosure of account status, represented by CWE‑204.

The affected product is WWBN AVideo, versions up to and including 26.0. No additional products or vendors are listed.

With a CVSS score of 5.3 and an EPSS score below 1 %, the vulnerability has moderate severity and low to moderate exploitation probability. The attacker requires only unauthenticated access to the public password recovery endpoint, indicating a remote network attack vector. Although the vulnerability is not listed in the CISA KEV catalog, it can still facilitate further attacks such as targeted credential stuffing or impersonation by exposing legitimate usernames and account states.