WWBN AVideo fails to verify watch permissions on the playListAddVideo.json.php endpoint when users add videos to playlists. An authenticated user can submit a video ID and a playlist ID to place a,. This flaw allows the user to embed restricted content in their own playlist. It is inferred that this could expose the content to other viewers, but that is not explicitly stated. The weakness is a classic missing authorization issue, classified as CWE‑862.

The vulnerability impacts the WWBN AVideo application, specifically the code changes introduced in commit c3edcc274c389816d434acadac07ee78eaf330c1. Users running this version or earlier are affected; upgrading to a patch that enforces the intended authorization check resolves the issue.

With a CVSS score of 5.3, the vulnerability presents moderate severity. EP not listed in CISA KEV, indicating no known widespread exploitation yet. Exploitation requires an active authenticated session and the ability to invoke the add‑video endpoint, so unauthenticated users cannot use this flaw. The risk is elevated for environments that permit users to add content to playlists without further restrictions, inferred from the need for authenticated access and the potential to place restricted videos into owned playlists. The situation should be monitored until a formal patch is applied.