{"id":"CVE-2025-34440","aliases":["EUVD-2025-203949","GHSA-8p6j-22m6-97x2"],"status":"published","title":"AVideo \u003c 20.1 Open Redirect via siteRedirectUri Parameter","description":"AVideo versions prior to 20.1 contain an open redirect vulnerability caused by insufficient validation of the siteRedirectUri parameter during user registration. Attackers can redirect users to external sites, facilitating phishing attacks.","severity":{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00195,"percentile":0.09347,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-601"],"published":"2025-12-17T19:48:57Z","modified":"2026-11-11T10:30:45Z","products":[{"vendor":"world wide broadcast network","product":"avideo"},{"vendor":"wwbn","product":"avideo"}],"references":[{"url":"https://github.com/WWBN/AVideo/commit/4a53ab2056","tags":["patch","Patch","fix"]},{"url":"https://github.com/WWBN/AVideo/commit/77c70019b0","tags":["patch","Patch","fix"]},{"url":"https://www.vulncheck.com/advisories/avideo-open-redirect-via-siteredirecturi-parameter","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/","tags":["technical-description","exploit","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-34440","tags":["advisory"]},{"url":"https://chocapikk.com/posts/2025/avideo-security-vulnerabilities"},{"url":"https://github.com/advisories/GHSA-8p6j-22m6-97x2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/34xxx/CVE-2025-34440.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-34440","title":"AVideo \u003c 20.1 Open Redirect via siteRedirectUri Parameter","description":"AVideo versions prior to 20.1 contain an open redirect vulnerability caused by insufficient validation of the siteRedirectUri parameter during user registration. Attackers can redirect users to external sites, facilitating phishing attacks.","status":"published","published":"2025-12-17T19:48:57.026Z","modified":"2026-06-23T16:13:32.658Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:32:54.534202Z"}],"euvd":[{"id":"EUVD-2025-203949","description":"AVideo versions prior to 20.1 contain an open redirect vulnerability caused by insufficient validation of the siteRedirectUri parameter during user registration. Attackers can redirect users to external sites, facilitating phishing attacks.","status":"published","published":"2025-12-17T19:48:57Z","modified":"2026-06-23T16:13:32Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:20:32.768333Z"}],"ghsa":[{"id":"GHSA-8p6j-22m6-97x2","title":"AVideo versions prior to 20.0 contain an open redirect vulnerability caused by insufficient...","description":"AVideo versions prior to 20.0 contain an open redirect vulnerability caused by insufficient validation of the siteRedirectUri parameter during user registration. Attackers can redirect users to external sites, facilitating phishing attacks.","status":"published","published":"2025-12-17T21:30:49Z","modified":"2025-12-19T21:30:18Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:05:18.038899Z"}],"nvd":[{"id":"CVE-2025-34440","description":"AVideo versions prior to 20.1 contain an open redirect vulnerability caused by insufficient validation of the siteRedirectUri parameter during user registration. Attackers can redirect users to external sites, facilitating phishing attacks.","status":"published","published":"2025-12-17T20:15:54.557Z","modified":"2026-06-17T09:13:59.643Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:11:51.309584Z"}],"osv":[{"id":"CVE-2025-34440","title":"AVideo \u003c 20.1 Open Redirect via siteRedirectUri Parameter","description":"AVideo versions prior to 20.1 contain an open redirect vulnerability caused by insufficient validation of the siteRedirectUri parameter during user registration. Attackers can redirect users to external sites, facilitating phishing attacks.","status":"published","published":"2025-12-17T19:48:57.026Z","modified":"2026-11-11T10:30:45.20026829Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-11T11:06:33.21514Z"}]}}