Skip to content

Security: IDOR in Video AI and Transcription Status Endpoints #1623

@lighthousekeeper1212

Description

@lighthousekeeper1212

Summary

Two API endpoints expose video metadata and allow triggering AI generation for any video without verifying the requesting user owns the video.

Vulnerability Details

1. GET /api/video/ai

In apps/web/app/api/video/ai/route.ts, the endpoint queries video by ID without checking ownerId against the authenticated user:

const result = await db()
  .select()
  .from(videos)
  .where(eq(videos.id, videoId));  // No ownerId check

This can expose AI metadata (summary, chapters) and also trigger AI generation on another user's video.

Contrast: The adjacent POST /api/videos/[videoId]/retry-ai/route.ts correctly checks:

if (video.ownerId !== user.id) {
  return Response.json({ error: "Unauthorized" }, { status: 403 });
}

2. GET /api/video/transcribe/status

Same pattern - queries video by ID without ownerId filter.

Impact

An authenticated user can read AI summaries/chapters of any user's private videos, and trigger AI generation on other users' videos.

Suggested Fix

Add ownerId verification after fetching the video:

const video = result[0];
if (video.ownerId !== user.id) {
  return Response.json({ error: "Unauthorized" }, { status: 403 });
}

This is the same pattern already used in retry-ai/route.ts.


Reported by lighthouse security research

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions