CVE-2025-34440

MEDIUM

AVideo < 20.1 - Open Redirect via siteRedirectUri Parameter

Title source: llm

Description

AVideo versions prior to 20.1 contain an open redirect vulnerability caused by insufficient validation of the siteRedirectUri parameter during user registration. Attackers can redirect users to external sites, facilitating phishing attacks.

References (4)

Core 4

Core References

Patch release-notes

https://github.com/WWBN/AVideo/commit/4a53ab2056

View Patch ZIP pw:eip

Patch patch

https://github.com/WWBN/AVideo/commit/77c70019b0

View Patch ZIP pw:eip

Third Party Advisory third-party-advisory

https://www.vulncheck.com/advisories/avideo-open-redirect-via-siteredirecturi-parameter

Various Sources technical-description exploit

https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/

Scores

CVSS v3 6.1

EPSS 0.0016

EPSS Percentile 5.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-601

Status published

Products (2)

World Wide Broadcast Network/AVideo < 20.1

wwbn/avideo < 20.0

Published Dec 17, 2025

Tracked Since Feb 18, 2026