{"id":"CVE-2026-123787","kind":"vulnerability","aliases":["CVE-2026-123787"],"related":[],"title":"VidBee: local HTTP service leaks information to remote attackers","description":"A weakness has been identified in nexmoe VidBee up to 1.3.13/2.0.2. The affected element is an unknown function of the file apps/desktop/src/main/local-api.ts of the component Local HTTP Service. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.2.0 is sufficient to fix this issue. This patch is called 141b8d39c1c11da4589264f814cee077df81e7f6. It is suggested to upgrade the affected component.","summary":"VidBee, a desktop video downloader, has a weakness in its Local HTTP Service (apps/desktop/src/main/local-api.ts) that lets a remote manipulation expose information. A public exploit exists, so an attacker could read data the app should keep private.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","local-http-service","other","vidbee"],"not_affected_if":["fixed-version-installed"],"how_to_check":"- Check the installed VidBee version; versions up to `1.3.13` and `2.0.2` are listed as affected.","fix":"- VidBee: upgrade to `2.2.0`; the patch commit is `141b8d39c1c11da4589264f814cee077df81e7f6`.","status":"open","published_at":"2026-11-06T21:17:07+00:00","first_seen_at":"2026-11-06T21:45:07+00:00","triaged_at":"2026-11-06T21:46:56+00:00","updated_at":"2026-11-06T21:46:56+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-06T21:46:56Z","model":"claude-haiku-5-5","output":{"fix":"- VidBee: upgrade to `2.2.0`; the patch commit is `141b8d39c1c11da4589264f814cee077df81e7f6`.","reach":"internet","title":"VidBee: local HTTP service leaks information to remote attackers","impact":"medium","summary":"VidBee, a desktop video downloader, has a weakness in its Local HTTP Service (apps/desktop/src/main/local-api.ts) that lets a remote manipulation expose information. A public exploit exists, so an attacker could read data the app should keep private.","audience":"everyone","category":"other","nicknames":[],"who_cares":["vidbee","desktop","local-http-service"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker reads information from the local HTTP service remotely","analyst_note":"","how_to_check":"- Check the installed VidBee version; versions up to `1.3.13` and `2.0.2` are listed as affected.","plain_action":"Update your VidBee app to version 2.2.0.","needs_analyst":false,"not_affected_if":["fixed-version-installed"],"who_is_affected":"Installations of VidBee up to 1.3.13 and 2.0.2 are affected, since the flaw sits in the app's Local HTTP Service. The sources do not say whether the service is on by default, so unknown whether every install is reachable. Installs already on 2.2.0 or later are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.001231,"input_tokens":4340,"output_tokens":1594,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123787':12A,15A '-2026':11A,14A '/2.0.2':70C '1.3.13':69C '141b8d39c1c11da4589264f814cee077df81e7f6':131C '2.2.0':120C 'affect':72C,138C 'app':55B 'apps/desktop/src/main/local-api.ts':36B,81C 'attack':9A,50B,97C,116C 'avail':107C 'call':130C 'compon':84C,139C 'could':51B,112C 'cve':10A,13A 'data':53B 'desktop':16B,25B 'disclosur':95C 'download':27B 'element':73C 'execut':88C 'exist':47B 'exploit':46B,103C 'expos':42B 'file':80C 'fix':124C 'function':77C 'http':3A,19B,34B,86C 'identifi':63C 'inform':6A,43B,94C 'issu':126C 'keep':57B 'launch':100C 'lead':92C 'leak':5A 'let':38B 'local':2A,18B,33B,85C 'local-http-servic':17B 'made':106C 'manipul':41B,90C 'nexmo':65C 'patch':128C 'privat':58B 'public':45B,110C 'read':52B 'remot':8A,40B,101C 'servic':4A,20B,35B,87C 'suffici':122C 'suggest':134C 'unknown':76C 'upgrad':117C,136C 'use':114C 'version':119C 'vidbe':1A,22B,23B,66C 'video':26B 'weak':30B,60C","nicknames":[],"mitigations":[],"who_affected":"Installations of VidBee up to 1.3.13 and 2.0.2 are affected, since the flaw sits in the app's Local HTTP Service. The sources do not say whether the service is on by default, so unknown whether every install is reachable. Installs already on 2.2.0 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your VidBee app to version 2.2.0.","pkeys":[],"ptokens":[],"labels":["desktop","localhttpservice","medium","other","vidbee"],"campaign_type":null,"search_a":"'-123787':12A,15A '-2026':11A,14A 'attack':9A 'cve':10A,13A 'http':3A 'inform':6A 'leak':5A 'local':2A 'remot':8A 'servic':4A 'vidbe':1A","search_b":"'app':55B 'apps/desktop/src/main/local-api.ts':36B 'attack':50B 'could':51B 'data':53B 'desktop':16B,25B 'download':27B 'exist':47B 'exploit':46B 'expos':42B 'http':19B,34B 'inform':43B 'keep':57B 'let':38B 'local':18B,33B 'local-http-servic':17B 'manipul':41B 'privat':58B 'public':45B 'read':52B 'remot':40B 'servic':20B,35B 'vidbe':22B,23B 'video':26B 'weak':30B","search_c":"'/2.0.2':70C '1.3.13':69C '141b8d39c1c11da4589264f814cee077df81e7f6':131C '2.2.0':120C 'affect':72C,138C 'apps/desktop/src/main/local-api.ts':81C 'attack':97C,116C 'avail':107C 'call':130C 'compon':84C,139C 'could':112C 'disclosur':95C 'element':73C 'execut':88C 'exploit':103C 'file':80C 'fix':124C 'function':77C 'http':86C 'identifi':63C 'inform':94C 'issu':126C 'launch':100C 'lead':92C 'local':85C 'made':106C 'manipul':90C 'nexmo':65C 'patch':128C 'public':110C 'remot':101C 'servic':87C 'suffici':122C 'suggest':134C 'unknown':76C 'upgrad':117C,136C 'use':114C 'version':119C 'vidbe':66C 'weak':60C","first_public_at":"2026-11-06T21:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123787","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123787","severity":null,"published_at":"2026-11-06T21:17:07+00:00","modified_at":"2026-11-06T21:17:07+00:00","first_seen_at":"2026-11-06T21:45:07+00:00","fetched_at":"2026-11-06T21:45:07+00:00","note":null}],"documents":[{"id":90304,"url":"https://github.com/nexmoe/VidBee/commit/141b8d39c1c11da4589264f814cee077df81e7f6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90305,"url":"https://github.com/nexmoe/VidBee/releases/tag/v2.2.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}