Security Vulnerability Disclosure: streamrecorder.io

Risk Assessment

Metric	Score / Rating
Likelihood	7.1 (HIGH)
Impact	6.3 (HIGH)
Overall Risk Rating	CRITICAL

Summary

Two API endpoints on streamrecorder.io fail to enforce access control, allowing any authenticated user to retrieve private recording metadata and direct download/stream URLs, including premium or paid content.

This is an Insecure Direct Object Reference (IDOR) vulnerability (CWE-639). Both endpoints accept user-supplied identifiers (targetid and video_id) and return the corresponding data without verifying that the requesting user has authorization to access it. Possession of a valid session cookie (i.e., being logged in as any user) is sufficient to query data belonging to any other user.

Affected Endpoints

1. GET https://streamrecorder.io/api/user/recordingsv2?targetid={user_id}&offset=0&limit=20&sortby=id&sortdir=desc
2. GET https://streamrecorder.io/recordings/stream/{video_id}

Proof of Concept

Prerequisites: A valid account on the platform and an HTTP intercepting proxy (e.g., Burp Suite, OWASP ZAP). For the purpose of this proof of concept, 99999 is used as the target user/video ID.

Reproducing IDOR #1 - Accessing Full Recording List

1. Log in to the platform with any valid account.
2. Enable request interception. Ensure session cookies are not redacted so requests are authenticated.
3. Navigate to https://streamrecorder.io/userrecordings and click any set of profiles/recordings to trigger the API call.
4. Intercept the following request:

GET /api/user/recordingsv2?targetid=99999&offset=0&limit=20&sortby=id&sortdir=desc HTTP/1.1
Host: streamrecorder.io
Cookie: [YOUR_VALID_SESSION_COOKIE]

5. Forward the request to a Repeater tool. Modify the targetid parameter to the ID of any account.
6. Send the request.

Result: The API returns the full recording list for the target profile in a JSON response, including metadata and direct source or download URLs for their recordings, regardless of whether those recordings are free or gated behind a paywall.

Reproducing IDOR #2 - Streaming or Downloading a Specific Premium Video

1. Identify the video ID of a target video. This can be found by hovering over a thumbnail in the recordings tab and extracting the numeric ID from the URL (or from the previous recording list, in the JSON response from the /recordings API):
   • Example: /media/99999/thumbv_large.jpg → video ID: 99999
2. Send the following request via the Repeater, substituting the target video ID (where 99999 is the free video, and 10000 is the premium video):

GET /recordings/stream/10000 HTTP/1.1
Host: streamrecorder.io
Cookie: [YOUR_VALID_SESSION_COOKIE]

Result: The response contains a direct, usable download or stream URL for the requested video, completely bypassing any subscription or access requirements.

Impact

• Revenue / IP Loss: Premium and paid video content can be directly streamed or downloaded without a valid purchase or subscription.
• Mass Exploitation: The vulnerable endpoints utilize sequential identifiers, making bulk scraping of the platform's paid content trivially feasible.

Recommended Remediation

1. Server-Side Authorization Checks: Before returning any data, verify on the server that the authenticated user is either the owner of the requested resource or has been explicitly granted access to it.
2. Avoid Direct Object References: Replace sequential internal IDs exposed in API parameters with non-guessable tokens (e.g., UUIDsv4 or signed tokens) that cannot be enumerated.
3. Signed, Expiring URLs: Generate stream and download URLs that are cryptographically signed and tied to a specific user session, with a short expiry window.
4. Rate Limiting & Anomaly Detection: Implement rate limiting on recording endpoints to detect and block bulk enumeration attempts.

Disclosure Timeline

• 2026-06-05: Vulnerability discovered.
• 2026-06-05: Initial disclosure sent to support team.
• 2026-06-08: Response / acknowledgment received.
• 2026-06-11: Contact via Telegram as directed, no response.
• 2026-07-07: Public disclosure.

---

Disclaimer

This report is submitted in good faith under responsible disclosure principles. No compensation was requested. The information provided in this repository is for educational and defensive purposes only. I am not responsible for how this information is used by third parties.