WWBN AVideo API::get_api_video information disclosure

Summaryinfo

A vulnerability identified as problematic has been detected in WWBN AVideo. This affects the function API::get_api_video. The manipulation leads to information disclosure. This vulnerability is uniquely identified as CVE-2026-88875. The attack is possible to be carried out remotely. No exploit exists. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability was found in WWBN AVideo (affected version not known). It has been rated as problematic. This issue affects the function API::get_api_video. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns joined from the video owner's user record, and API::get_api_video() calls removeSensitiveUserFields() only when the caller is neither authenticated nor using a valid API secret; it never compares User::getId() with the row's users_id. As a result, any low-privilege authenticated account can request another user's video and receive the owner's email address, account name (user), and isAdmin, canUpload and canStream flags, which are removed for guests and should be returned only to the owner or to callers with a valid API secret. No patched version was available at the time of the advisory.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-88875 since 09/10/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Applying the patch c3edcc274c389816d434acadac07ee78eaf330c1 is able to eliminate this problem.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• WWBN

Name

• AVideo

License

• open-source

Website

• Product: https://github.com/WWBN/AVideo/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion