AVideo Unauthenticated User Data Exposure

AVideo, a video sharing platform, is affected by a broken access control vulnerability.

Unauthenticated users can access complete user records, including password hashes, recovery tokens, and live session identifiers, by providing a specific hash parameter in videoViewsInfo endpoints.

This allows attackers to hijack viewer sessions, including administrator accounts, and obtain sensitive personal data for all video viewers.