WWBN AVideo, through commit c3edcc274c389816d434acadac07ee78eaf330c1, lacks a user authorization check in the mediaSession.json.php endpoint. An unauthenticated attacker can request this endpoint with a video ID parameter and receive video metadata that may include password‑protected titles and owner email addresses. The vulnerability exposes sensitive information, enabling privacy violations and potential phishing or social engineering attacks. The weakness is characterized as an Information Disclosure flaw (CWE‑200).

The affected product is WWBN AVideo. Any deployment that includes the mediaSession.json.php endpoint before the commit c3edcc274c389816d434acadac07ee78eaf330c1 is vulnerable. Administrators should verify whether their instance includes that commit or a later release and apply the most recent upstream update if possible. AVideo contains a missing authorization check in the mediaSession.json.php endpoint.

The CVSS score of 6.9 indicates moderate severity with significant confidentiality impact. The EPSS score of <1% indicates a very low but nonzero probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a direct web request to mediaSession.json.php with a video ID parameter; because the service does not perform authentication, any attacker who can reach the host can retrieve the disclosed metadata. The exploitation path is simple and does not require special conditions, making the vulnerability easily exploitable for information gathering.