The vulnerability in WWBN AVideo arises from missing authorization checks in the videoAddViewCount.json.php endpoint. Specifically, the system fails to verify whether the authenticated user has permission to access a given video before incrementing its view count and watch-time statistics. An attacker with valid authentication can exploit this flaw by sending crafted requests with arbitrary video IDs, thereby inflating view metrics for videos they cannot legitimately view. This issue was identified through commit c3edcc274c389816d434acadac07ee78eaf330c1. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low attack complexity, no user interaction, and requiring low privileges.

Authenticated attackers can manipulate video view counts and watch-time statistics for videos they do not have access to. This could lead to inaccurate analytics, potential reputational damage, and misuse of platform metrics. There is no indication of direct data disclosure or system compromise from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions where possible and monitor for anomalous view count activity related to unauthorized videos.