AVideo’s API does not fully sanitize sensitive user fields in the APIName=video response. When a low‑privilege authenticated user requests another user’s video, the response includes the owner’s email address, account name, isAdmin, canUpload and canStream flags. The code removes these fields only when the caller is neither authenticated nor has a valid API secret, but it never verifies that the requestor matches the video’s owner. This leads to exposure of personal and privilege information to attackers who have any authenticated account. The vulnerability is a classic information‑disclosure flaw (CWE‑359).

The issue is present in the AVideo application provided by WWBN, specifically the master branch at revision c3edcc274c389816d434acadac07ee78eaf330c1 dated 2026‑08‑23. All installations running this commit or any later unreleased versions lacking the fix are affected. No specific version range is listed beyond this commit, so any instance deploying the unpatched code is at risk.

The CVSS score of 5.3 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Given that the flaw can be triggered by any authenticated user, the exploitation conditions are low: the attacker only needs valid user credentials, which can be obtained through compromised accounts or social engineering. The likely attack vector is a network API call to get_api_video with standard authentication. The moderate CVSS and the possibility of evading coverage by the KEV suggest that the vulnerability should be remedied promptly, but the risk of widespread exploitation is currently limited by the need for an authenticated account.