The API returned
playingUrl for Voice 57
with issubscriber: false, user_access: deny, and paid_for: true.The
video_name + serverhost from the API response are used to construct
the CDN URL above — confirming that the CDN file for this specific movie is
publicly accessible with no authentication.
Moo Jin-Hyuk (Jang Hyuk) was a popular detective who solved major cases, but after his wife was murdered by a serial killer his life spiraled down. He is filled with guilt that he was not able to protect his wife and he secretly looks for her killer. Meanwhile, Kang Kwon-Joo (Lee Ha-Na) graduated at police academy with top marks. She began to work at an emergency 112 call center. Working there, a brutal murder case takes place and her father/police sergeant went to the crime scene. Her father is killed there and Kwon-Joo hears what happened over the phone. Afterwards, she goes to the U.S. to study and comes back to Korea as a professional voice profiler. Detective Jin-Hyuk and Kang Kwon-Joo solve cases together. Chasing a serial killer responsible for the deaths of their family member.
API Response Evidence — Vulnerability Proof
Finding: The server sets user_access=deny and
issubscriber=false but still returns playingUrl in the
same response. Subscription is enforced client-side only — any caller with
the expired APK JWT can obtain stream URLs without a subscription.
Munowatch CDN (b-cdn.net) serves content with no auth required
(direct HTTP Range requests succeed with HTTP 206).
{
"id": 52643,
"video_title": "Voice 57",
"description": " Moo Jin-Hyuk (Jang Hyuk) was a popular detective who solved major cases, but after his wife was murdered by a serial killer his life spiraled down. He is filled with guilt that he was not able to protect his wife and he secretly looks for her killer.\r\n\r\nMeanwhile, Kang Kwon-Joo (Lee Ha-Na) graduated at police academy with top marks. She began to work at an emergency 112 call center. Working there, a brutal murder case takes place and her father/police sergeant went to the crime scene. Her father is killed there and Kwon-Joo hears what happened over the phone. Afterwards, she goes to the U.S. to study and comes back to Korea as a professional voice profiler.\r\n\r\nDetective Jin-Hyuk and Kang Kwon-Joo solve cases together. Chasing a serial killer responsible for the deaths of their family member. ",
"video_name": "voice 57-vj [s4-13].mp4",
"filehistory": "",
"openload": "0",
"embedurl": "",
"serverhost": "57",
"allow_openload": "0",
"full_video_name": "",
"duration": "01h 00m",
"thumbnail": "https://apposters.b-cdn.net/laba/yo/naki/EeNkb3kKHe1695.jpg",
"tfilehistory": "",
"category_id": 5,
"language_id": 1,
"recording_date": "2024-05-28",
"age_id": "18 +",
"location": 1,
"tab_category_id": 5,
"series_code": "46072",
"access": "1",
"paid_for": "1",
"new_movie": "1",
"priority": "No",
"size": "493.94 MB",
"create_date": "2024-10-18 05:10:51",
"schedule_date": "28.05.2024 12:37:45 PM",
"user_id": 1118356,
"vj_id": 5,
"video_status_id": 0,
"network_id": "45.221.8.174",
"user_access": "deny",
"notification": "",
"secduration": "3635.000000",
"issubscriber": false,
"genre": "Series",
"vjname": "Vj Shao Khan",
"trailer_playing_url": "",
"episodes": 58,
"episode_state": "NEXT",
"nxt_eps": "EPS 58",
"nxt_eps_id": 52644,
"nxt_eps_title": "Voice 58",
"nxt_ldur": 0,
"nxt_playing_url": "https://munowatch.co/clips/ELI.mp4",
"playingUrl": "https://munowatch.co/clips/ELI.mp4",
"ldur": 0,
"session_id": "cb99afb5b31411a57538a97393de0e2e",
"device": "web",
"lang_name": "English to Luganda",
"vjrelease": "2 years ago",
"mstatus": false,
"kstatus": "",
"substatus": "EXPIRED"
}