CVE-2025-34435

8.7 highEPSS 0.3%

High (8.7) in wwbn avideo. EPSS 0.3% chance of exploitation in the next 30 days.

AVideo versions prior to 20.1 are vulnerable to an insecure direct object reference (IDOR) that allows any authenticated user to delete media files belonging to other users. The affected endpoint validates authentication but fails to verify ownership or edit permissions for the targeted video.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
CWE: CWE-639
Published: 2025-12-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

wwbn:avideo

References

https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/
https://github.com/WWBN/AVideo/commit/275a54268b
https://github.com/WWBN/AVideo/commit/4a53ab2056
https://www.vulncheck.com/advisories/avideo-idor-arbitrary-file-deletion

Check your stack JSON