Servers and applications
GHSA-7qrc-6vhr-4rhj
Video password disclosure in the video_from_program API for accessible playlists
- Severity
- Medium 5.3
- Published
- 13 Nov 2026
- Last changed
- 13 Nov 2026
- Added to UpHeron
- 13 Nov 2026
- Attack
- Over the network · No login needed · No user action needed
- Attacker can
- Read some data
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N- Sources
- Project advisories (GitHub)
Description
AVideo through 29.7.1 exposes stored video passwords through API::get_api_video_from_program when a playlists_id is supplied for a playlist the caller can access. Anonymous callers can retrieve these values from public or unlisted playlists containing password-protected videos.
The confirmed path uses PlayLists::getOnlyVideosAndAudioIDFromPlaylistLight() to retrieve raw video rows. These rows are nested under the response's videos array and do not pass through per-row cleanUpRowFromDatabase(). The top-level response cleanup therefore does not remove the stored video_password value. Playlist visibility checks do not authorize disclosure of video passwords.
The stored value is a bcrypt hash, or a legacy plaintext password for older videos. Hash disclosure permits offline password guessing; plaintext disclosure directly compromises the affected video's password protection.
Affected software
| Software | Affected versions |
|---|---|
AVideoServers and applications · github:wwbn/avideo |
|
References
- GitHub Advisory Database https://github.com/advisories/GHSA-7qrc-6vhr-4rhj
- github.com https://github.com/WWBN/AVideo/security/advisories/GHSA-7qrc-6vhr-4rhj