The vulnerability is an unsanitized SQL injection in the subscribe endpoint of the AVideo platform. The user_id parameter is concatenated directly into an INSERT statement, enabling any authenticated user to inject SQL and read data from any table, including password hashes and API keys. This allows compromise of confidential credentials and potentially full system takeover in the database layer.

The flaw exists in the AVideo open‑source video platform produced by WWBN in all releases through version 26.0. The affected code resides in objects/subscribe.php and is accessed via the subscribe.json.php and subscribeNotify.json.php endpoints.

With a base CVSS score of 7.1 and an extremely low EPSS (<1%), the vulnerability is serious but unlikely to be widely exploited yet. The attacker requires authentication to reach the vulnerable endpoint, but any authenticated account can exploit it. CISA has not listed it in its KEV catalog, indicating no known widespread exploitation. The patch in commit 36dfae22059fbd66fd34bbc5568a838fc0efd66c removes the unsanitized concatenation and restores parameterized queries.