CVE-2025-34439mediumCWE-601

AVideo < 20.1 Open Redirect via cancelUri Parameter

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.8epss 0.2%

probabilidade de exploração

0.2%top 93% das CVEs

exploração observada

nãonenhuma fonte reporta

AVideo versions prior to 20.1 are vulnerable to an open redirect flaw due to missing validation of the cancelUri parameter during user login. An attacker can craft a link to redirect users to arbitrary external sites, enabling phishing attacks.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Produtos afetados

World Wide Broadcast Network · AVideo

Referências

https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/https://github.com/WWBN/AVideo/commit/4a53ab2056 https://github.com/WWBN/AVideo/commit/88bc40427b https://www.vulncheck.com/advisories/avideo-open-redirect-via-canceluri-parameter