CVE-2025-34439

4.8 mediumEPSS 0.2%

Medium (4.8) in wwbn avideo. EPSS 0.2% chance of exploitation in the next 30 days.

AVideo versions prior to 20.1 are vulnerable to an open redirect flaw due to missing validation of the cancelUri parameter during user login. An attacker can craft a link to redirect users to arbitrary external sites, enabling phishing attacks.

Severity

CVSS 4.0

4.8 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 9% of CVEs (scores of 2026-10-31)
CWE: CWE-601
Published: 2025-12-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

wwbn:avideo

References

https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/
https://github.com/WWBN/AVideo/commit/4a53ab2056
https://github.com/WWBN/AVideo/commit/88bc40427b
https://www.vulncheck.com/advisories/avideo-open-redirect-via-canceluri-parameter

Check your stack JSON