CVE-2026-33759: AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents

March 26, 2026 (updated March 27, 2026)

The objects/playlistsVideos.json.php endpoint returns the full video contents of any playlist by ID without any authentication or authorization check. Private playlists (including watch_later and favorite types) are correctly hidden from listing endpoints via playlistsFromUser.json.php, but their contents are directly accessible through this endpoint by providing the sequential integer playlists_id parameter.

References

github.com/WWBN/AVideo
github.com/WWBN/AVideo/commit/bb716fbece656c9fe39784f11e4e822b5867f1ca
github.com/WWBN/AVideo/security/advisories/GHSA-75qq-68m8-pvfr
github.com/advisories/GHSA-75qq-68m8-pvfr
nvd.nist.gov/vuln/detail/CVE-2026-33759

Code Behaviors & Features

Detect and mitigate CVE-2026-33759 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →