https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-19T07:39:27.355791+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-278195 EUVD-2026-278195 2026-10-19T07:39:27.358089+00:00 EUVD-2026-278195 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34369 fkie_cve-2026-34369 2026-10-19T07:39:27.358119+00:00

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_video_file` and `get_api_video` API endpoints in AVideo return full video playback sources (direct MP4 URLs, HLS manifests) for password-protected videos without verifying the video password. While the normal web playback flow enforces password checks via the `CustomizeUser::getModeYouTube()` hook, this enforcement is completely absent from the API code path. An unauthenticated attacker can retrieve direct playback URLs for any password-protected video by calling the API directly. Commit be344206f2f461c034ad2f1c5d8212dd8a52b8c7 fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-q6jj-r49p-94fh GHSA-q6jj-r49p-94fh — AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verifica… 2026-10-19T07:39:27.358151+00:00

Affected: Packagist: wwbn/avideo

## Summary

The `get_api_video_file` and `get_api_video` API endpoints in AVideo return full video playback sources (direct MP4 URLs, HLS manifests) for password-protected videos without verifying the video password. While the normal web playback flow enforces password checks via the `CustomizeUser::getModeYouTube()` hook, this enforcement is completely absent from the API code path. An unauthenticated attacker can retrieve direct playback URLs for any password-protected video by calling the API directly.

## Details

The video password protection is enforced in the web UI via `CustomizeUser::getModeYouTube()` (`plugin/CustomizeUser/CustomizeUser.php:787`), which calls `videoPasswordIsGood()` before rendering the video player. However, this hook is only invoked during web page rendering — the API endpoints bypass it entirely.

**Vulnerable endpoint 1 — `get_api_video_file` (`plugin/API/API.php:986-1004`):**

```php public function get_api_video_file($parameters) { global $global; $obj = $this->startResponseObject($parameters); $obj->videos_id = $parameters['videos_id']; if (!self::isAPISecretValid()) { if (!User::canWatchVideoWithAds($obj->videos_id)) { return new ApiObject("You cannot watch this video"); } } $video = new Video('', '', $obj->videos_id); $obj->filename = $video->getFilename(); // ... $obj->video_file = Video::getHigherVideoPathFromID($obj->videos_id); $obj->sources = getSources($obj->filename…