WWBN AVideo contains an authorization bypass flaw in the Users_affiliations add.json.php endpoint that lets an authenticated user craft a two‑party consent record by supplying the counterparty's agreement timestamp. The application accepts this forged record and later trusts it when a user invokes videoAddNew.json.php, allowing the attacker to change the ownership of videos to arbitrary accounts. The weakness arises from a flaw in how the system validates authorization terms, which is classified as CWE‑345.

Any deployment of WWBN AVideo that is running the vulnerable codebase, including releases prior to the security fix associated with commit 9c39d8c8b4c1f75540788d6b391740852ceb0732, is affected. The issue appears in the Users_affiliations add.json.php and videoAddNew.json.php endpoints and may impact all users with authentication privileges. The specific version numbers are not listed in the advisory, so administrators should check whether their installed version contains the vulnerability.

The CVSS score is 7.1, indicating moderate to high severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation currently. The likely attack vector requires an authenticated user; an attacker can gain privileges by creating a forged affiliation and then reassigning video ownership through trusted endpoints. The combination of authentication and lack of proper authorization checks makes exploitation feasible for any user with access to the application.