CVE-2025-34440

4.8 mediumEPSS 0.2%

Medium (4.8) in wwbn avideo. EPSS 0.2% chance of exploitation in the next 30 days.

AVideo versions prior to 20.1 contain an open redirect vulnerability caused by insufficient validation of the siteRedirectUri parameter during user registration. Attackers can redirect users to external sites, facilitating phishing attacks.

Severity

CVSS 4.0

4.8 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 9% of CVEs (scores of 2026-10-31)
CWE: CWE-601
Published: 2025-12-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

wwbn:avideo

References

https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/
https://github.com/WWBN/AVideo/commit/4a53ab2056
https://github.com/WWBN/AVideo/commit/77c70019b0
https://www.vulncheck.com/advisories/avideo-open-redirect-via-siteredirecturi-parameter

Check your stack JSON