The vulnerability resides in WWBN AVideo's commentAddNew.json.php endpoint, where the code fails to verify whether an authenticated user has permission to view a video before a result, any user who has logged in can submit a POST request with a valid session token and add comments to videos that are protected by passwords or restricted to specific groups. This bypasses the intended access controls and permits the publication of comments on content that the user should not be able to access.

The vulnerability affects WWBN AVideo,cc274c389816d434acadac07ee78eaf330c1. No specific release numbers are listed, so any installation that has not applied a patch addressing this commit is potentially vulnerable.

The CVSS score of 5.3 indicates a medium impact. The EPSS score is not available, and the vulnerability is not currently listed in CISA's KEV catalog. Exploitation requires a valid authenticated session; an attacker can trick a victim into providing their session or use an existing session token to post comments to restricted videos. Because the attack vector is limited to authenticated POST requests but the ability to deface or spam protected video content is still concerning.