CVE-2025-34441

HIGH

AVideo < 20.1 - Unauthenticated Exposure of Sensitive User Information via Public API

Title source: llm

Description

AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administrative status, and last login times, enabling user enumeration and privacy violations.

References (4)

Core 4

Core References

Patch release-notes

https://github.com/WWBN/AVideo/commit/4a53ab2056

View Patch ZIP pw:eip

Patch patch

https://github.com/WWBN/AVideo/commit/1416c517e2

View Patch ZIP pw:eip

Third Party Advisory third-party-advisory

https://www.vulncheck.com/advisories/avideo-user-information-disclosure-via-public-api

Various Sources technical-description exploit

https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/

Scores

CVSS v3 7.5

EPSS 0.0073

EPSS Percentile 49.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-359

Status published

Products (2)

World Wide Broadcast Network/AVideo < 20.1

wwbn/avideo < 20.0

Published Dec 17, 2025

Tracked Since Feb 18, 2026