AVideo allows owners to set passwords for videos, but the passwords are stored directly in the database without hashing, salting, or encryption. When an attacker can read the database, all video passwords are exposed in cleartext, compromising the confidentiality of protected content. This flaw is a direct result of improper storage of sensitive data, matching the weakness type of plain data storage without protection.

The vulnerability affects the WWBN AVideo platform, specifically all releases up to and including version 26.0. Users of these versions who employ the video password feature are at risk, while newer releases that have applied the patch are not affected.

The CVSS score of 9.1 classifies this as critical, indicating a high impact should an exploit succeed. The EPSS score is below 1%, suggesting low current exploitation probability, and the vulnerability is not yet listed in CISA’s KEV catalog. Exploitation requires the attacker to gain read access to the database, which could be achieved through SQL injection, recovery of a backup, or misconfigured database permissions. Once read access is achieved, all passwords are released in plaintext, allowing unauthorized viewing of protected videos.