CVE-2025-34435

AVideo versions prior to 20.1 arevulnerable to an insecure direct object reference (IDOR) that allows any authenticated user to delete media files belonging to other users. The affected endpoint validates authentication but fails to verify ownership or edit permissions for the targeted video.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
VulnCheckCNA
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 16%
VendorProductVersion
wwbnavideo
𝑥
< 20.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/
https://github.com/WWBN/AVideo/commit/275a54268b
https://github.com/WWBN/AVideo/commit/4a53ab2056
https://www.vulncheck.com/advisories/avideo-idor-arbitrary-file-deletion