CVE-2026-126545

MEDIUM 4.3

WWBN AVideo through 29.7.1 Missing Authorization via get_api_tags API

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get_api_tags() in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored video_password values of unlisted, group-restricted and password-protected videos, enabling unauthorized viewing.

CWE	CWE-862
Vendor	wwbn
Product	avideo
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for wwbn avideo

Be the first to know when new medium vulnerabilities affecting wwbn avideo are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

WWBN / AVideo

0 ≤ 29.7.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/WWBN/AVideo/security/advisories/GHSA-3w98-8958-84rh github.com: https://github.com/WWBN/AVideo/commit/a8d1e0e484d655556422841d08b2b0fb64332721 github.com: https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/API/API.php#L958-L976 github.com: https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/VideoTags/Objects/TagsHasVideos.php#L172-L180 vulncheck.com: https://www.vulncheck.com/advisories/wwbn-avideo-through-29.7.1-missing-authorization-via-get-api-tags-api

Credits

AlpetGexha