Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

wwbn/avideo

              master @ 66801a7
            

481

Fixes

CVEs

CRITICAL

Peak severity

30.8%

Coverage

Highlights

Auth Bypass: 92 prior fixes. Scrutinize any change in this area.

objects/user.php: most-fixed (48 issues). Treat as high-risk during review.

360 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Live stream key and token validation has been repeatedly bypassed via type juggling, missing checks, forged tokens, and weak hash validation, enabling unauthorized stream access or key disclosure.

Broken Access Control / IDOR: Video ownership and edit permission checks are frequently missing or inconsistently applied across CRUD and image endpoints, allowing users to modify or delete others' videos.

SSRF: SSRF protection in url_get_contents and related fetchers has been iteratively hardened (DNS pinning, redirect validation, IP checks), but multiple endpoints still fetch user-controlled URLs, risking internal network access.