WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability rooted in the getToken() function, which generates tokens without binding them to a specific user identity or intended purpose. The Gallery plugin endpoint (plugin/Gallery/view/sections.php) issues these valid tokens to unauthenticated visitors, creating a critical security gap. Attackers can obtain a token from the Gallery endpoint without any authentication and then reuse it to bypass authorization controls in other subsystems, such as view/hls.php. This allows unauthorized access to restricted video content that should require proper authentication. The vulnerability represents a flawed token issuance and validation design, effectively nullifying access controls across multiple subsystems. No user interaction is required beyond a simple unauthenticated request to the Gallery endpoint.
