The vulnerability arises from missing authentication checks in the report4.json.php and report4.1.json.php endpoints of WWBN AVideo. When accessed, these scripts return daily and cumulative user‑registration counts without verifying any session or authorization token. This exposure allows any external party to retrieve sensitive statistics that could reveal user growth trends or other operational data, constituting a confidentiality breach (CWE‑200).

AVideo versions up to and including 30.0 are affected. The issue is present in all releases of the software that contain the vulnerable report4.json.php scripts and does not appear in later releases that enforce authentication.

With a CVSS score of 6.9, the vulnerability is moderate in severity but can be exploited by any attacker able to send unauthenticated GET requests to the affected endpoints. The EPSS score is not available and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting that exploitation is possible but not yet widely observed. The lack of authentication means that the attack vector is straightforward and does not require any pre‑existing privileges or credential compromise.