CVE-2025-34441: AVideo < 20.1 User Information Disclosure via Public API
AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administrative status, and last login times, enabling user enumeration and privacy violations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AVideoto a version that resolves this vulnerability.Fixed in 20.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34441?
CVE-2025-34441 is considered a high severity vulnerability due to the exposure of sensitive user information.
How do I fix CVE-2025-34441?
To fix CVE-2025-34441, upgrade AVideo to version 20.0 or later, which addresses the vulnerability.
What information is exposed in CVE-2025-34441?
CVE-2025-34441 exposes sensitive user information including emails, usernames, administrative status, and last login times.
Can CVE-2025-34441 lead to user enumeration?
Yes, CVE-2025-34441 allows for user enumeration due to the exposure of identifiable user information.
Is user authentication required to exploit CVE-2025-34441?
No, CVE-2025-34441 can be exploited through an unauthenticated public API endpoint.