WWBN AVideo contains a cross‑site request forgery flaw in the releaseVideoNow.json.php endpoint that accepts GET requests without authenticating the caller. An attacker can send a crafted cross‑site GET request that carries an administrative session cookie, causing the server to permanently publish any embargoed video identified by the videos_id parameter. This grants an attacker the ability to make restricted video content publicly available without permission, potentially exposing sensitive material and compromising the integrity of the platform.

The vulnerability affects the WWBN AVideo application, specifically the code committed as 9c39d8c8. Versions or deployments that include this commit or earlier have not yet been patched; users should upgrade to a release that removes the vulnerable endpoint or otherwise eliminates the unauthenticated GET behavior.

The CVSS score of 7.1 labels the issue as high severity. EPSS data are not available, but the flaw requires only a valid administrative session cookie and a simple GET request, making exploitation relatively straightforward once the victim is seeded. The vulnerability is not listed in the CISA KEV catalog, yet the likelihood of attack remains high due to the widespread use of cross‑site request techniques. The primary attack vector is a malicious web page or script that coerces an admin user's browser to hit the vulnerable endpoint with their credentials in transit.