WWBN AVideo, at commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a missing authorization vulnerability in the playlistsFromUser.json.php endpoint. This flaw allows unauthenticated attackers to retrieve private playlists such as Favorite and Watch Later belonging to other users by requesting their user identifiers. The root cause is improper cache keying that conflates requests across different user contexts, leading to exposure of sensitive information without authentication or privileges.

Attackers can read private playlist data of other users without authentication, potentially exposing user preferences and viewing habits. This unauthorized information disclosure impacts user privacy but does not indicate direct code execution or system compromise.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint or implement additional authorization checks to prevent unauthorized access to user playlists.