Vulnerability · Published Mar 9, 2026 · Assigned by GitHub_M

CVE-2026-30885WWBN AVideo - Unauthenticated IDOR - Playlist Information Disclosure

Medium 5.5

In plain English

A medium-severity missing authentication in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.5Medium

Exploit odds (30 days)0.4%top 62.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WWBN AVideo is an open source video platform. Prior to 25.0, the /objects/playlistsFromUser.json.php endpoint returns all playlists for any user without requiring authentication or authorization. An unauthenticated attacker can enumerate user IDs and retrieve playlist information including playlist names, video IDs, and playlist status for any user on the platform. This vulnerability is fixed in 25.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	wwbn/avideo	25.0	GHSA-6w2r-cfpc-23r5

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	< 25.0

Weakness: CWE-306, CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-6w2r-cfpc-23r5 x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/12adc66913724736937a61130ae2779c299445ca x_refsource_MISC