Threats tagged 'ghsa-2pqq-779r-37qg'

WWBN AVideo versions through 29.7.1 have an incorrect authorization vulnerability that allows delegated Videos Admin users to retrieve video_id_hash values of any video owner via encoder endpoints. This flaw enables attackers to obtain hashes for administrator-owned videos and use them to perform password-less logins, gaining unauthorized access to plugin upload, configuration, and user management features.