CVE-2026-34369 is a missing authorization vulnerability (CWE-862) in WWBN AVideo up to version 26.0. The vulnerability exists because the API endpoints get_api_video_file and get_api_video do not verify the password for password-protected videos before returning direct playback URLs such as MP4 files and HLS manifests. This bypasses the intended access control enforced in the normal web playback flow, allowing unauthenticated attackers to retrieve video playback sources directly via the API. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality only. The issue is resolved by a specific code commit that adds the missing authorization checks.

An unauthenticated attacker can bypass password protection on videos by directly calling vulnerable API endpoints to retrieve direct playback URLs. This leads to unauthorized disclosure of video content, impacting confidentiality. There is no impact on integrity or availability. No known exploits in the wild have been reported.

A fix is available and has been implemented in the codebase as commit be344206f2f461c034ad2f1c5d8212dd8a52b8c7. Users should upgrade to a version that includes this fix or apply the patch from this commit to ensure that API endpoints properly enforce password verification. Since this is not a cloud service, remediation depends on applying the patch or upgrading the affected software.