The vulnerability is in AVideo's videoAddViewCount.json.php handler, which does not validate that a requesting user has permission to view a video before incrementing its view count and watch‑time. An authenticated attacker can send requests with arbitrary video IDs and inflate the statistics of videos they are not authorized to view, thereby corrupting analytics, revenue calculations and reputational data. This is an authorization bypass flaw (CWE‑862) that lowers the integrity of statistical metrics, but it does not allow code execution or compromise of confidential data.

The affected product is WWBN's AVideo platform. No version range is specified in the CVE; the issue was found in the code base at commit c3edcc274c389816d434acadac07ee78eaf330c1 and applies to any release that has not installed versions against the commit history to determine exposure.

The CVSS score of 5.3 indicates medium severity, and no EPSS score is provided. The vulnerability is not listed in the CISA KEV catalog. The exploit requires an authenticated user but does. By repeatedly sending crafted requests to the endpoint, an attacker can inflate view counts for unviewable videos. The primary risk is the integrity of analytics and revenue reporting, with a moderate threat level due to the lack of exploitation probability data.