WWBN AVideo fails to verify that a user has permission to view a video before allowing the user to record a like via the like.json.php endpoint. This omission means that any authenticated user can submit like requests for videos that are password‑protected or belong to a restricted group. The resulting incremented like counter can be used to entice visitors or manipulate popularity metrics, and it also provides a subtle way to confirm the existence and accessibility of protected content. The weakness is an access‑control flaw (CWE‑862).

The vulnerability affects the WWBN AVideo platform across all releases prior to commit c3edcc274c389816d434acadac07ee78eaf330c1. Users running older builds or custom forks that have not applied this commit are susceptible.

The CVSS score of medium severity range. No EPSS data is available, and it does not appear in the CISA KEV catalog. The most likely attack vector is an authenticated web user who can issue HTTP requests to the like.json.php endpoint; no privileges beyond a logged‑in session are required. Once authenticated, the attacker can target any protected video URL to increment its like count, effectively bypassing the intended access restrictions. To succeed, the victim must have a login session and the ability to send the appropriate JSON payload to the endpoint.