The flaw in the YPTWallet users.json.php endpoint allows any authenticated user to retrieve the complete list of platform users along with their personal information and wallet balances. Because the code only checks for generic authentication and never confirms administrative privileges, attackers can harvest sensitive data by simply logging into the system. The vulnerability is a classic example of missing authority checks, categorized as CWE-862, resulting in privacy compromise for all registered users.

The issue affects the WWBN AVideo open‑source video platform, specifically versions 26.0 and earlier. The problematic endpoint resides in the YPTWallet plugin. Anyone running an affected instance, regardless of the underlying operating system, is potentially vulnerable if the plugin is installed.

The CVSS base score of 6.5 signals a medium‑severity risk. EPSS indicates less than 1% chance of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. Exploitation requires only that the user is authenticated; an attacker who creates a free account or compromises another user’s credentials can trigger the data dump. No publicly available patch exists at publication, so the vulnerability remains exploitable until an update is released.