# Images and Subtitles Leakage from private videos

Vimeo's embed player leaked thumbnail sprites, subtitle track URLs, and HD cover images for private-but-embeddable videos to unauthenticated users.

- Payout: hidden
- Severity: medium
- Program: Vimeo
- Found by: opnsec
- Disclosed: 2017-10-18
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/136850
- Library page: https://bugbountylibrary.com/r/h1%3A136850
- Tags: area:web domain:web impact:data-leak impact:integrity kind:bounty platform:hackerone sev:medium tech:php vuln:access-control vuln:info-disclosure

**Target:** player.vimeo.com embed player endpoint
**Root cause:** The embed player page embeds thumb_preview sprite URLs, text_tracks subtitle URLs, and background cover image URLs in its HTML for private-but-embeddable videos without checking viewer authorization.
**Steps:**
1. Request `https://player.vimeo.com/video/[VIDEO_ID]` for a private but embeddable video without authentication.
2. Inspect source for `"thumb_preview":{"url":"...sprite/..."}` to obtain a sprite of up to 120 thumbnails.
3. Extract `text_tracks` entries with `url` like `/texttrack/4448008.vtt?token=...` and download subtitles.
4. Send the same request via PHP without a User-Agent header to receive the HD cover image `background:url('https://i.vimeocdn.com/video/..._640.jpg')`; strip the size suffix for max resolution.
**How found:** Researcher inspected the source of the embed player page for private videos and noticed thumbnail sprite, subtitle track, and cover image URLs present despite no access rights; also observed a different response (HD cover) when no User-Agent was sent.
**Exploitation:** Unauthenticated attacker requests the embed player for a private video ID, parses the HTML for sprite and subtitle URLs, downloads them, and reassembles thumbnails into a video preview with subtitles.
**Insight:** Embed player HTML often pre-renders media metadata (sprites, subtitle tokens, cover images) for client-side playback; check these for private/unlisted content and test header variations (e.g. missing User-Agent) that may route to alternate render paths leaking more.