WWBN AVideo contains an authorization bypass flaw where the getToken() routine builds authentication tokens that are not tied to a specific user or purpose. The Gallery plugin exposes an endpoint that distributes these unbound tokens to any visitor, allowing an attacker to acquire a valid token without authenticating. With a captured token, the attacker can then call other protected endpoints, such as view/hls.php, to retrieve or stream video content that is otherwise restricted to authorized users.

This issue affects any installation of WWBN AVideo that includes or is based on commit 9c39d8c8 and has not yet applied the vendor’s patch. The flaw resides in the core token generation logic and the Gallery plugin’s token distribution module. Administrators should verify whether their deployment contains the unfixed commit or a newer release that addresses the bug.

The CVSS score of 8.7 classifies the vulnerability as high severity, reflecting its potential to expose private data without authentication. The EPSS score is not available, limiting visibility into current exploitation likelihood, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a remote HTTP request to the Gallery endpoint; the flaw requires no credentials and can be exploited by any unauthenticated user, making the attack practical and potentially impactful if the attacker gains access to restricted video streams.