Home

Description

AVideo versions prior to 20.1 are vulnerable to an insecure direct object reference (IDOR) that allows any authenticated user to delete media files belonging to other users. The affected endpoint validates authentication but fails to verify ownership or edit permissions for the targeted video.

PUBLISHED Reserved 2025-04-15 | Published 2025-12-17 | Updated 2025-12-19 | Assigner VulnCheck




HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-639 Authorization Bypass Through User-Controlled Key

Product status

Default status
unaffected

Any version before 20.1
affected

Credits

Valentin Lobstein (Chocapikk) finder

References

github.com/WWBN/AVideo/commit/4a53ab2056 release-notes

github.com/WWBN/AVideo/commit/275a54268b patch

www.vulncheck.com/...ies/avideo-idor-arbitrary-file-deletion third-party-advisory

chocapikk.com/posts/2025/avideo-security-vulnerabilities/ technical-description exploit

cve.org (CVE-2025-34435)

nvd.nist.gov (CVE-2025-34435)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.