SECURITY PoC — NO AUTH
This movie's CDN stream is playing without login or subscription
No Tail To Tell 12 — Episodes (24 of 24)
EP 1No Tail To TellEP 2No Tail To Tell 2EP 3No Tail To Tell 3EP 4No Tail To Tell 4EP 5No Tail To Tell 5EP 6No Tail To Tell 6EP 7No Tail To Tell 7EP 8No Tail To Tell 8EP 9No Tail To Tell 9EP 10No Tail To Tell 10EP 11No Tail To Tell 11EP 12No Tail To Tell 12EP 13No Tail To Tell 13EP 14No Tail To Tell 14EP 15No Tail To Tell 15EP 16No Tail To Tell 16EP 17No Tail To Tell 17EP 18No Tail To Tell 18EP 19No Tail To Tell 19EP 20No Tail To Tell 20EP 21No Tail To Tell 21EP 22No Tail To Tell 22EP 23No Tail To Tell 23EP 24No Tail To Tell 24
Per-movie CDN bypass proof
The API returned
playingUrl for No Tail To Tell 12
with issubscriber: false, user_access: deny, and paid_for: true.
The video_name + serverhost from the API response are used to construct
the CDN URL above, confirming that the file for this specific movie is
publicly accessible with no authentication.
Security research evidence Inspect entitlement results, CDN URLs, and the raw API response Access control failed
API response evidence
Endpoint called
GET /api/preview/v2/64407/0
User ID used
0 (no user / not logged in)
JWT used
Expired Feb 2024 (extracted from APK)
issubscriber
false
user_access
deny
paid_for
YES (premium content)
substatus
EXPIRED
serverhost
72
video_name
12-No.Tail.to.Tell-Vj Ivo.mp4
playingUrl returned
YES — URL in response
API playingUrl value
https://munowatch.co/clips/ELI.mp4
CDN stream
https://munotech2.b-cdn.net/kabuzi/kabuzi42/12-No.Tail.to.Tell-Vj%20Ivo.mp4
Finding: The server sets user_access=deny and
issubscriber=false but still returns playingUrl in the
same response. Subscription is enforced client-side only — any caller with
the expired APK JWT can obtain stream URLs without a subscription.
Munowatch CDN (b-cdn.net) serves content with no auth required
(direct HTTP Range requests succeed with HTTP 206).