User Information Exposure in AVideo by WWBN
CVE-2025-34441

6.9MEDIUM

Key Information:

Vendor

World Wide Broadcast Network

Status
Avideo
Vendor
CVE Published:
17 December 2025

Badges

👾 Exploit Exists

What is CVE-2025-34441?

AVideo versions prior to 20.0 are susceptible to an information disclosure vulnerability due to an unauthenticated public API endpoint. This flaw allows attackers to access sensitive data, including users' email addresses, usernames, administrative statuses, and last login timestamps. Such exposure can lead to potential user enumeration and violations of privacy, posing serious risks to individuals' data security.

Affected Version(s)

AVideo 0 < 20.1

References

https://github.com/WWBN/AVideo/commit/4a53ab2056
release-notes
https://github.com/WWBN/AVideo/commit/1416c517e2
patch
https://www.vulncheck.com/advisories/avideo-user-informat...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Valentin Lobstein (Chocapikk)
JSON
.