Medium severity · published Dec 17, 2025
CVE-2025-34439
AVideo < 20.1 Open Redirect via cancelUri Parameter
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
AVideo versions prior to 20.1 are vulnerable to an open redirect flaw due to missing validation of the cancelUri parameter during user login. An attacker can craft a link to redirect users to arbitrary external sites, enabling phishing attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AV
AVideo · World Wide Broadcast Network
before 20.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-34439
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-34439
chocapikk.com
https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/
Patch
https://github.com/WWBN/AVideo/commit/4a53ab2056
Patch
https://github.com/WWBN/AVideo/commit/88bc40427b
Third Party Advisory
https://www.vulncheck.com/advisories/avideo-open-redirect-via-canceluri-parameter
More from AVideo
9.3
CVE-2025-34433
AVideo < 20.1 Unauthenticated RCE via Predictable Installation Salt
9.1
CVE-2025-34434
AVideo < 20.1 ImageGallery Plugin Unauthenticated File Upload and Deletion
8.8
CVE-2025-34437
AVideo < 20.1 IDOR Arbitrary Comment Image Upload
8.8
CVE-2025-34436
AVideo < 20.1 IDOR Arbitrary File Upload
8.1
CVE-2025-34438
AVideo < 20.1 IDOR Arbitrary Video Rotation