AVideo has Unauthenticated IDOR - Playlist Information Disclosure
Product: AVideo (https://github.com/WWBN/AVideo) Version: Latest (tested March 2026) Type: Insecure Direct Object Reference (IDOR) Auth Required: No User Interaction: None
Summary
The /objects/playlistsFromUser.json.php endpoint returns all playlists for any user without requiring authentication or authorization. An unauthenticated attacker can enumerate user IDs and retrieve playlist information including playlist names, video IDs, and playlist status for any user on the platform.
Root Cause
The endpoint accepts a users_id parameter and directly queries the database without any authentication or authorization check.
File: objects/playlistsFromUser.json.php
if (empty($_GET['users_id'])) {
die("You need a user");
}
// NO AUTHENTICATION CHECK
// NO AUTHORIZATION CHECK (does this user_id belong to the requester?)
$row = PlayList::getAllFromUser($_GET['users_id'], false);
echo json_encode($row);There is no call to User::isLogged() or any comparison between the requesting user and the target users_id.
Affected Code
| File | Line | Issue |
|---|---|---|
objects/playlistsFromUser.json.php |
10-21 | No authentication or authorization check before returning playlist data |
Proof of Concept
Retrieve admin's playlists (user ID 1)
curl "https://TARGET/objects/playlistsFromUser.json.php?users_id=1"Response:
[
{"id":false,"name":"Watch Later","status":"watch_later","users_id":1},
{"id":false,"name":"Favorite","status":"favorite","users_id":1}
]Impact
- Privacy violation — any visitor can see all users' playlist names and contents
- User enumeration — valid user IDs can be discovered by iterating through IDs
- Information gathering — playlist names and video IDs reveal user interests and private content preferences
- Targeted attacks — gathered information can be used for social engineering or further exploitation
Remediation
Add authentication and authorization checks:
// Option 1: Require authentication + only own playlists
if (!User::isLogged()) {
die(json_encode(['error' => 'Authentication required']));
}
if ($_GET['users_id'] != User::getId() && !User::isAdmin()) {
die(json_encode(['error' => 'Access denied']));
}
// Option 2: If public playlists are intended, filter by visibility
$row = PlayList::getAllFromUser($_GET['users_id'], false, 'public');Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | wwbn/avideo | < 25.0 | 25.0 |
Referencias
- Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P- Debilidad (CWE)
CWE-306, CWE-862- Plataforma
- Composer
- Paquete
wwbn/avideo- Publicada
- 07.03.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-6w2r-cfpc-23r5 - CC BY 4.0
Historial de vulnerabilidades: wwbn/avideo
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 160
- Primera → última
- 04.2022 06.2026
- Sin corrección
- 143
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 14
- Alta 61
- Media 83
- Baja 2
Divulgaciones por año
- 2022: 2
- 2023: 5
- 2024: 5
- 2025: 0
- 2026: 148
-
AVideo has Unauthenticated IDOR - Playlist Information Disclosure esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.