The vulnerability lies in the API endpoints that return full playback URLs for password‑protected videos without verifying the password. This means an attacker can obtain direct MP4 or HLS URLs to bypass the intended privacy controls. The weakness is a missing authentication check, which falls under the typical ‘Missing Authorization’ pattern. An attacker who succeeds can view, download, or redistribute content that was meant to be restricted, compromising confidentiality and potentially violating licensing agreements.

The issue affects the WWBN AVideo open‑source platform, specifically versions up to and including 26.0. Any deployment using these versions that hosts password‑protected videos is vulnerable. The vulnerability originates in the get_api_video_file and get_api_video API endpoints governed by the getModeYouTube() hook for web playback, which is not applied here.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1 % suggests low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit the flaw by making unauthenticated API calls to the vulnerable endpoints, directly retrieving playback URLs without providing any credentials. The lack of authentication checks in the API path is the key exploit path; no additional prerequisites beyond access to the API are indicated by the description.