CVE-2025-34441 | THREATINT

Description

AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administrative status, and last login times, enabling user enumeration and privacy violations.

PUBLISHED Reserved 2025-04-15 | Published 2025-12-17 | Updated 2025-12-19 | Assigner VulnCheck

MEDIUM: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Problem types

CWE-359 Exposure of Private Personal Information to an Unauthorized Actor

Product status

Default status

unaffected

Any version before 20.1

affected

Credits

Valentin Lobstein (Chocapikk) finder

References

github.com/WWBN/AVideo/commit/4a53ab2056 release-notes

github.com/WWBN/AVideo/commit/1416c517e2 patch

www.vulncheck.com/...r-information-disclosure-via-public-api third-party-advisory

chocapikk.com/posts/2025/avideo-security-vulnerabilities/ technical-description exploit

cve.org (CVE-2025-34441)

nvd.nist.gov (CVE-2025-34441)

Download JSON