CVE-2025-34441 json
AVideo < 20.1 User Information Disclosure via Public API
published 2025-12-17 10 mo ago modified 2026-06-23 4 mo ago also EUVD-2025-203938
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 58%
- public exploits
- 1
- Metasploit
Summary
AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administrative status, and last login times, enabling user enumeration and privacy violations.
Patch / fix
- World Wide Broadcast Network AVideo 20.1
- github.com/WWBN/AVideo@4a53ab2 commit
- github.com/WWBN/AVideo@1416c51 commit
Timeline
- Published
- First public exploit (Metasploit exploit/multi/http/avideo_notify_ffmpeg_unauth_rce)
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 10 mo ago
Exploit prediction
0.85% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/multi/http/avideo_notify_ffmpeg_unauth_rce AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery metasploit exploit, excellent rank, 2025-12-19
- chocapikk.com https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected products
- World Wide Broadcast Network AVideo
Classification
- Weakness
-
- CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
References
-
github.com
/WWBN/AVideo/commit/4a53ab2056
patch
-
github.com
/WWBN/AVideo/commit/1416c517e2
patch
-
chocapikk.com
/posts/2025/avideo-security-vulnerabilities/
technical-description, exploit
-
vulncheck.com
/advisories/avideo-user-information-disclosure-via-public-api
third-party-advisory
Sources
- CVE List CVE-2025-34441
- NVD CVE-2025-34441
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.