The vulnerability exists in the API endpoint get_api_video_password_is_correct, which exposes a boolean password correctness response without requiring authentication or rate limiting. Because the response is deterministic, an attacker can iterate candidate passwords and determine the correct password for any protected video manually. This leads to unauthorized disclosure of video content, violating confidentiality, and enabling further attacks such as phishing or content theft. The weakness is a classic authentication failure (CWE‑307).

The flaw affects the WWBN AVideo open‑source video platform. Versions up to and including 26.0 contain the vulnerable endpoint. Upgrading to a later version or applying the patch removes the oracle.

CVSS assessment of 5.3 indicates moderate severity. The EPSS score of less than 1 % reflects a low likelihood of widespread exploitation at present, and the vulnerability is not listed in CISA’s KEV. Attackers can exploit the path by issuing unauthenticated HTTP requests to the vulnerable endpoint until the correct password is discovered. The lack of rate limiting means that the attack can be automated with minimal effort, and a successful compromise would grant full access to any protected video. Once patched, the vector is closed and the risk is returned to a baseline level.