Servers and applications
GHSA-3w98-8958-84rh
Missing authorization in API get_api_tags: subscribing to any tag returns raw videos rows, leaking unlisted videos (filename/title) and the stored video_password (plaintext for pre-v29 videos, bcrypt otherwise) to any registered user
- Severity
- Medium 4.3
- Published
- 9 Nov 2026
- Last changed
- 9 Nov 2026
- Added to UpHeron
- 9 Nov 2026
- Sources
- Project advisories (GitHub)
Affected software
| Software | Affected versions |
|---|---|
AVideoServers and applications · github:wwbn/avideo |
|
References
- GitHub Advisory Database https://github.com/advisories/GHSA-3w98-8958-84rh
- github.com https://github.com/WWBN/AVideo/security/advisories/GHSA-3w98-8958-84rh