An attacker who can access a public endpoint, feed/index.php, can provide any public channel name as a parameter and receive the channel owner’s email address within the itunes:email and itunes:author RSS elements. The data is delivered without authentication, meaning that any web‑connected user can discover the email addresses of all channel owners. The attacker can then use these addresses in phishing or social‑engineering campaigns to impersonate the owner or to attempt credential compromise. The vulnerability falls under CWE‑200, Information Exposure.

The affected application is WWBN:AVideo (AVideo). The vulnerability is present in versions that contain commit 9c39d8c8 and any subsequent releases that have not applied a corrective change. No specific product version numbers are provided by the advisory, so administrators should verify whether their deployed instance includes the vulnerable code base or has been patched since that commit.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, which means the probability of exploitation is currently undefined, but the lack of a KEV marking suggests no known active exploitation at this time. Nonetheless, the attack is remote, unauthenticated, and can be automated by enumerating public channel names. The risk is that an attacker can harvest many emails, potentially leading to a broad phishing campaign and facilitating targeted account takeover attempts. Administrators should consider the exposure of sensitive data and the ease with which the flaw can be exploited when deciding on remediation.