The vulnerability is an unauthenticated Insecure Direct Object Reference in the objects/playlistsVideos.json.php endpoint of the AVideo platform. An attacker can supply any numerical playlist ID as a parameter and receive the full list of videos belonging to that playlist with no authentication or authorization checks. Because private playlists, such as watch_later and favorite, are not hidden by the listing endpoints, this flaw allows anyone to exfiltrate the contents of all private playlists associated with any user. The weakness, captured by CWE‑639 and CWE‑862, results in a disclosure of potentially sensitive video data.

The flaw is present in all AVideo releases up to and including version 26.0. Users running any of these affected releases, regardless of deployment size, are vulnerable. No additional version details are supplied; up‑to‑date installations beyond 26.0 are presumed unpatched.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Attackers can exploit the flaw by crafting a simple HTTP request to the affected endpoint with a chosen playlists_id value, requiring only internet connectivity and no special credentials. Because the payload is unauthenticated, any person can retrieve the private playlist contents, leading to privacy violations and potential downstream data leakage.