An unauthenticated broken access control vulnerability in WWBN AVideo allows attackers to extract sensitive user records and hijack administrative sessions, posing a critical risk to data privacy and system integrity.

The application fails to perform proper authorization checks on the videoViewsInfo endpoint. When a hash parameter is provided, the system discloses user password hashes, recovery tokens, and session identifiers to any unauthenticated caller.

The exploitation of this vulnerability leads to a total compromise of user confidentiality and account integrity. An attacker can harvest sensitive personal data for all platform users and perform account takeovers, including those with administrative privileges, which could result in full system control and severe reputational damage. Given the CVSS score of 9.1, this vulnerability is classified as critical due to the ease of remote, unauthenticated exploitation.

Immediate Action: Since a specific patch version is not currently identified, administrators should consult the official WWBN AVideo GitHub security advisory for the latest available security updates or configuration workarounds.

Proactive Monitoring: Review web server access logs for anomalous requests directed at the videoViewsInfo endpoint, particularly those containing unexpected or repetitive hash parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or rate-limit requests to the videoViewsInfo endpoint, specifically targeting requests that include the vulnerable hash parameter.

Public Exploit Available: Unknown

This vulnerability represents a significant security failure that requires immediate attention from security teams managing AVideo instances. Organizations must prioritize monitoring the official project repository for the release of a corrective patch and apply it immediately upon availability. Until a fix is deployed, restricting external access to the affected endpoint is the most effective way to prevent unauthorized data exfiltration and session hijacking.