The vulnerability allows an unauthenticated caller of AVideo's API endpoints to obtain direct video playback URLs for content that is otherwise protected by a password. Because the API path does not perform the same password check that the normal web player uses, the attacker can retrieve the full MP4 and HLS stream locations and play them without any credential. This results in unauthorized disclosure of the protected video media and undermines the platform's privacy controls. The weakness is a missing authorization check (CWE-862).

AVideo, the open source video platform maintained by WWBN, is affected in all released versions up to and including 26.0. Users running any of these versions and relying on the protected-video feature should verify which version they are using. Later revisions after the fix are not impacted.

The CVSS score of 5.3 indicates a medium severity risk, and the absence of network restriction means any external actor can call the API without authentication. Because the vulnerability does not rely on a complex condition or privilege escalation, it is relatively easy to exploit, subject to the availability of the video ID, which is generally public. Although the vulnerability is not presently listed in CISA's KEV catalog and EPSS data are not available, the straightforward nature of the attack and the potential for privacy loss make immediate remediation advisable.