The vulnerability allows any visitor, including those who are not logged in, to request two specific endpoints in the AVideo application. One endpoint accepts an arbitrary isCompany flag and internally flips a guard that normally limits user data to administrators. The second endpoint accepts a users_id identifier and returns detailed information about the requested user without checking permissions. Both paths expose the complete list of registered accounts, including identifiers, display names, channel URLs, profile images, background settings, status messages, and the total number of accounts. The result is a full oracle of user information that can be harvested by an attacker.

WWBN AVideo releases up to and including version 29.0 are affected. Users running any build derived from those versions are susceptible to the two unauthenticated data‑exposure paths. The vulnerability was addressed in a commit published on the AVideo repository, which updates the underlying logic to enforce proper access checks.

The CVSS score of 5.3 places the issue in the medium severity range. EPSS data is not available, indicating no public exploitation statistics, and the vulnerability is not listed in the CISA KEV catalog. However, the attack vector is straightforward: an attacker simply sends an HTTP GET request to the exposed endpoints from any network reachability angle. No authentication or privilege escalation is required, so discovery and execution can occur with minimal effort. The risk is primarily the accidental or intentional collection of user data, which can be leveraged for phishing or social engineering attacks. In the absence of active exploitation reports, the probability of exploitation remains low to moderate, but the potential impact on privacy makes remediation important.