Rajivraj

An unbounded per-connection queue exists in the `WebSocketServerExtensionHandler`. The handler adds an entry to its `validExtensions` queue for every inbound `HttpRequest` but only removes an entry when the application writes an `HttpResponse`. A remote, unauthenticated attacker can utilize HTTP/1.1 pipelining—a technique where multiple requests are sent over a single TCP connection without waiting for the corresponding responses—to send requests faster than the application can respond. This causes the queue to grow indefinitely, leading to JVM heap memory exhaustion and an `OutOfMemoryError`. Since this handler is the base class for `WebSocketServerCompressionHandler`, servers enabling `permessage-deflate` are exposed on their plain HTTP port before WebSocket upgrades or application-level authentication occur.

A ByteBuf leak exists in the `StompSubframeDecoder` function. When a frame's declared content-length is fully read, the decoder allocates a chunk buffer and waits for the terminating NUL byte. If this byte is not received, the buffer is not released because the signal thrown by `skipNullCharacter()` extends Error instead of Exception, bypassing the release path. Additionally, the decoder does not override `handlerRemoved0` or `channelInactive`, allowing the buffer to persist after channel teardown. A remote peer can trigger this leak by sending a well-formed frame body without the terminating NUL byte, potentially leading to memory exhaustion as the pooled allocator does not reclaim the memory.

A broken access control flaw exists in the 'objects/userVerifyEmail.php' endpoint. The script disables login requirements via the `$global['ignoreUserMustBeLoggedIn']` variable and accepts the `users id` parameter directly from the query string. It calls the `User::sendVerificationLink()` function without requiring a session, a CSRF token, a relationship check between the caller and the target, or the `enforceRateLimit()` function. Because the rate limit is tied to the caller's session, requests made without cookies are not limited. This allows an unauthenticated remote attacker to send an unlimited number of verification emails to any account ID and enumerate accounts and their verification status based on the JSON responses. Furthermore, the `createVerificationCode()` function triggers `$user->setRecoverPass()`, which saves a live password-recovery token to the targeted account. This token is sent in base64 format within the verification link and is accepted by the 'objects/userRecoverPassSave.json.php' endpoint as a valid credential for setting a new password.

An authentication bypass exists in the PGP second factor verification of the LoginControl component. The issue occurs because challenge responses are compared using loose equality against an uninitialized session variable. An attacker who possesses a victim's password can bypass the second factor authentication by sending a GET request without parameters to the 'verifyChallenge.json.php' endpoint, causing the system to evaluate `null == null` and mark the authentication as complete.

Authenticated attackers can cause a desynchronization between stored votes and counters because the `Like:: construct()` function performs counter arithmetic on raw request values before they are validated. By sending array-typed like parameters followed by standard requests, an attacker can drive video like counts to arbitrarily negative values. This corruption persists in the denormalized counter, which is a redundant copy of data used to improve read performance, until it is manually repaired.

The `autoCSRFGuard()` function uses a hardcoded allowlist of exempt basenames that are tested without directory context. This allows plugin files that share names with core filenames to inherit Cross-Site Request Forgery (CSRF) exemptions. Specifically, the LoginWordPress plugin file `login.json.php` inherits such an exemption, which allows it to unconditionally log out authenticated users during cross-site POST requests before credentials are validated.

Broken access control exists in the `clean title` branch of the 'get api video' API endpoint. This flaw allows anonymous callers to bypass group restrictions by querying videos via their public slug, resulting in the unauthorized disclosure of Personally Identifiable Information (PII) of the video owner. Exposed sensitive fields include email, phone, address, birth date, and administrator status.

An authentication bypass exists where the stored password hash is accepted as a valid login credential. This occurs through two independent code paths in the `loginFromRequest()` and `encryptPasswordVerify()` functions. Attackers who obtain the stored `users.password` hash value can authenticate as any user by submitting the hash directly to login endpoints, bypassing password verification.

A stored cross-site scripting issue exists where the unauthenticated endpoint 'objects/videoAddViewCount.json.php' calls the `VideoStatistic::save()` function. This process writes the caller's `User-Agent` string, retrieved via `getUserAgentInfo()`, directly into the `app` column of the videos statistics table without proper sanitization through `setApp()`, as `normalizeApp()` only truncates the value. When a video owner or administrator accesses the statistics page 'view/videoViewsInfo.php', the field is rendered using an unescaped renderer in DataTables 1.12.1. Because DataTables uses innerHTML to assign cell content, attacker-supplied HTML is executed within the authenticated session of the privileged user.

A race condition exists in the `enforceRateLimit()` function that fails to atomically increment rate limit counters. This allows attackers to bypass all rate limits, including login brute-force protection, by issuing concurrent requests. Consequently, attackers can submit parallel credential attempts to exceed the 30-attempts-per-5-minutes login limit by a factor determined by their connection concurrency.

Cross-site request forgery occurs because the endpoint 'objects/videoAddNew.json.php' disables the automatic CSRF guard (`$global['skipAutoCSRFCheck']`) and the untrusted-request check (`$global['bypassSameDomainCheck']`) when the `user` and `pass` parameters are present in the request. These values are read from `$ REQUEST` without validation, allowing an attacker to include them in a cross-site request query string. Since the function `User::loginFromRequestIfNotLogged()` returns immediately if a session already exists, an authenticated victim satisfies the check while the attacker's credentials are ignored. This allows an attacker to lure users with upload rights to a crafted page and submit cross-origin requests to modify video records, including `setUsers id` for ownership transfer, `can download`, `can share`, `only for paid`, `video password`, `rating`, `status`, creation date, and view count. Users with administrator or `Permissions::canAdminVideos()` rights can have any video on the site altered, including the removal of group restrictions from private content.

Failure to enforce user-group restrictions allows unauthenticated attackers to retrieve restricted live transmission details. This information includes stream keys, titles, descriptions, owner information, and direct HLS (HTTP Live Streaming) playback URLs. The issue occurs when accessing the 'plugin/Live/stats.json.php' and 'plugin/Live/calendar.json.php' endpoints.

The software exposes an undocumented login path through the `get api preauthorize()` function in plugin/API/API.php. Unlike the standard login process, this path does not implement rate limiting via the `checkRateLimit()` function, allowing unlimited remote password guessing against any account, including administrators. Additionally, the endpoint functions as a credential oracle; while it returns a generic "Invalid credentials" message for all attempts, the `users id` field in the response body reveals the authentication status (`users id:1` for success and `users id:0` for failure). A successful attempt also establishes a session cookie that can be used for authenticated API requests, enabling unauthenticated brute-force account takeover.

The API fails to enforce rate limits when clients use a bot User-Agent header. This allows attackers to bypass eight protected operations, including login brute-force protection, by sending requests with a bot User-Agent to disable rate limiting. Consequently, an attacker can perform unlimited password guessing attempts against any account from a single IP address.

AVideo generates passwords for external-login accounts using the `rand()` function instead of a cryptographically secure generator, which limits the output to 31-bit integers. Additionally, the software uses unsalted MD5-based hashing for these passwords. This combination allows attackers who obtain the password hashes to recover the plaintext passwords quickly via offline brute-force attacks.

When the YPTSocket plugin is enabled, a cross-site scripting issue exists via the websocket callback mechanism. Unauthenticated attackers can execute arbitrary JavaScript in the browsers of other users by sending crafted socket messages. This occurs when callback names resolve to global functions, such as `avideoConfirmHTML()`, which accept untrusted data and assign it to `innerHTML`, allowing script execution in the victim's origin without authentication or user interaction.

A path traversal issue exists in the 'notify.ffmpeg.json.php' endpoint. Unauthenticated attackers can write files to arbitrary locations within the application root and subdirectories by providing a custom path via the `avideoRelativePath` parameter. This is possible because the system allows the replay of previously issued ciphertext as a `notifyCode` token, which is decrypted but not validated, effectively bypassing authentication.

Broken access control in the 'videoViewsInfo' endpoint allows unauthenticated callers to retrieve complete user records when a `hash` parameter is provided. The exposed data includes password hashes, recovery tokens, and live session identifiers. This can lead to the hijacking of viewer sessions, including those of administrator accounts, and the unauthorized acquisition of sensitive personal data for all video viewers.

Improper validation of access controls on the public channel page allows unauthenticated visitors to view unlisted and group-restricted videos. This occurs through the use of hardcoded visibility flags and an undefined property. Attackers can access the channel endpoint to retrieve sensitive content, such as full URLs to unlisted videos and thumbnails of member-only content, bypassing the `hidePrivateVideos` setting.

Broken access control exists in the unauthenticated 'feed/index.php' endpoint. When the `program id` parameter is supplied, per-video visibility checks are disabled. This allows attackers to enumerate playlist identifiers and retrieve unlisted or group-restricted videos by requesting the RSS feed with any visible playlist ID, including empty playlists that may return the entire hidden video catalogue of the site.