CVE-2025-34441 affects AVideo by World Wide Broadcast Network, where versions prior to 20.1 allow unauthenticated access to a public API endpoint that discloses private personal information. The exposed information includes user emails, usernames, administrative privileges, and last login timestamps. This vulnerability enables unauthorized actors to enumerate users and violate privacy. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability.

Unauthorized actors can access sensitive user information without authentication, facilitating user enumeration and privacy violations. This exposure may lead to further targeted attacks or social engineering but does not directly indicate system compromise or data modification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor the vendor's communications for updates and apply any forthcoming patches promptly. Until a fix is available, restricting access to the vulnerable API endpoint or implementing authentication controls may reduce exposure.