Open Redirect in wwbn/avideo


Reported on

Sep 8th 2021

✍️ Description

There is an open redirect vulnerability in the following URL:

🕵️‍♂️ Proof of Concept

Step to reproduce
1. open above URL
2. signup in the application
3. you redirect to

💥 Impact

That causes a redirection to an arbitrary external domain. This behavior can be leveraged to facilitate phishing attacks against users of the application. The ability to use an authentic application URL, targeting the correct domain and with a valid SSL certificate (if SSL is used), lends credibility to the phishing attack because many users, even if they verify these features, will not notice the subsequent redirection to a different domain. also it can chain with some other vulnerabilities like SSRF, etc.

2 years ago


Hey Musio, the security policy provided by the repo doesn't provide contact information. I've opened a PR asking for one.

2 years ago


hi @admin the maintainer accepts your PR but they do not provide email for security. i leaved a comment for providing email. if you can contact them for this again.

2 years ago


Hey Musio, looks like they've just added an email! Just emailed the maintainer for you.

We have contacted a member of the wwbn/avideo team and are waiting to hear back 2 years ago
wwbn/avideo maintainer marked this as fixed with commit a11802 2 years ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
to join this conversation