WWBN AVideo has a broken access control flaw in the videoViewsInfo endpoint. When a hash parameter is supplied the endpoint returns a full user record, including password hashes, recovery tokens, and active session identifiers. The disclosed session identifiers can be used to hijack viewer sessions, even those belonging to administrators, and to exfiltrate sensitive personal data for all video viewers. The weakness is classified as CWE‑200, an information exposure flaw.

The vendor is WWBN and the affected product is AVideo. No specific version details are listed in the advisory, so all deployed instances of AVideo are potentially vulnerable until the vendor releases a fix.

The flaw carries a CVSS score of 9.3, indicating high severity. EPSS data is not available, so the exact exploitation probability cannot be quantified, but the lack of a KEV listing does not diminish the risk. Attackers can exploit the vulnerability remotely without authentication by supplying the hash parameter in a request to the videoViewsInfo endpoint, thereby gaining access to sensitive data and hijacking sessions.