WWBN AVideo version 0 contains an authorization bypass vulnerability in the videosAndroid.json.php endpoint, introduced by commit c3edcc274c389816d434acadac07ee78eaf330c1. This flaw permits unauthenticated guests to enumerate password-protected videos and obtain sensitive owner information including email addresses, last login timestamps, filenames, and hash IDs by sending unauthenticated GET requests. The CVSS 4.0 base score is 6.9, indicating a medium severity impact with network attack vector, low complexity, and no privileges or user interaction required.

Attackers can retrieve sensitive metadata related to password-protected videos without authentication, potentially exposing owner email addresses and other private information. This exposure could lead to privacy violations or facilitate further targeted attacks against video owners. However, the vulnerability does not allow modification or deletion of data, nor does it enable direct system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the videosAndroid.json.php endpoint through network controls or authentication enforcement to prevent unauthenticated access.