WWBN AVideo contains a missing authorization check in the mediaSession.json.php endpoint. The code returns video metadata—including protected titles and owner email addresses—without verifying that the requestor is authenticated. Consequently an attacker can retrieve sensitive information about password‑protected videos, exposing personal data and enabling possible phishing or social engineering attacks. This flaw is a classic information‑disclosure weakness (CWE‑200).

The affected product is WWBN AVideo. Any deployment that includes the mediaSession.json.php endpoint before the commit c3edcc274c389816d434acadac07ee78eaf330c1 is vulnerable. Administrators should verify whether their instance includes that commit or a later release and apply the most recent upstream update if possible.

The CVSS score of 6.9 indicates moderate severity with significant confidentiality impact. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a direct web request to mediaSession.json.php with a video ID parameter; because the service does not perform authentication, any attacker who can reach the host can retrieve the disclosed metadata. The exploitation path is simple and does not require special conditions, making the vulnerability easily exploitable for information gathering.