CVE-2025-34441

AVideo < 20.1 User Information Disclosure via Public API

AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administrative status, and last login times, enabling user enumeration and privacy violations.

Affected

World Wide Broadcast Network · AVideo

CVSS v4.0 VULNCHECK

6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.85% chance of exploitation in the next 30 days, 58th percentile

Published

2025-12-17

Updated

2026-06-23

Proof-of-concept exploits (1)

• https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/avideo_notify_ffmpeg_…

Security advisories

• https://www.vulncheck.com/advisories/avideo-user-information-disclosure-via-public-api
• WWBN/AVideo/commit/1416c517e2

References

• CVE Record
• NVD entry