WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_video_password_is_correct` API endpoint allows any unauthenticated user to verify whether a given password is correct for any password-protected video. The endpoint returns a boolean `passwordIsCorrect` field with no rate limiting, CAPTCHA, or authentication requirement, enabling efficient offline-speed brute-force attacks against video passwords. Commit 01a0614fedcdaee47832c0d913a0fb86d8c28135 contains a patch.

Affected: Packagist: wwbn/avideo

## Summary

The `get_api_video_password_is_correct` API endpoint allows any unauthenticated user to verify whether a given password is correct for any password-protected video. The endpoint returns a boolean `passwordIsCorrect` field with no rate limiting, CAPTCHA, or authentication requirement, enabling efficient offline-speed brute-force attacks against video passwords.

## Details

The vulnerable endpoint is defined at `plugin/API/API.php:1111-1133`:

```php public function get_api_video_password_is_correct($parameters) { $obj = new stdClass(); $obj->videos_id = intval($parameters['videos_id']); $obj->passwordIsCorrect = true; $error = true; $msg = '';

if (!empty($obj->videos_id)) { $error = false; $video = new Video('', '', $obj->videos_id); $password = $video->getVideo_password(); if (!empty($password)) { $obj->passwordIsCorrect = $password == $parameters['video_password']; } } else { $msg = 'Videos id is required'; }

return new ApiObject($msg, $error, $obj); } ```

The `get()` dispatcher at `API.php:191-209` routes GET requests directly to this method without any authentication enforcement:

```php public function get($parameters) { // ... optional user login if credentials provided ... $APIName = $parameters['APIName']; if (method_exists($this, "get_api_$APIName")) { $str = "\$object = \$this->get_api_$APIName(\$parameters);"; eval($str); }…