CVE-2025-34440 | THREATINT

Description

AVideo versions prior to 20.1 contain an open redirect vulnerability caused by insufficient validation of the siteRedirectUri parameter during user registration. Attackers can redirect users to external sites, facilitating phishing attacks.

PUBLISHED Reserved 2025-04-15 | Published 2025-12-17 | Updated 2025-12-19 | Assigner VulnCheck

MEDIUM: 4.8CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Problem types

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Product status

Default status

unaffected

Any version before 20.1

affected

Credits

Valentin Lobstein (Chocapikk) finder

References

github.com/WWBN/AVideo/commit/4a53ab2056 release-notes

github.com/WWBN/AVideo/commit/77c70019b0 patch

www.vulncheck.com/...-redirect-via-siteredirecturi-parameter third-party-advisory

chocapikk.com/posts/2025/avideo-security-vulnerabilities/ technical-description exploit

cve.org (CVE-2025-34440)

nvd.nist.gov (CVE-2025-34440)

Download JSON