# All Vimeo Private videos disclosure via Authorization Bypass

Vimeo's ?action=share Ajax endpoint leaked the config token for private videos in its error response, letting anyone fetch and play any private video.

- Payout: hidden
- Severity: high
- Program: Vimeo
- Found by: opnsec
- Disclosed: 2016-07-29
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/137502
- Library page: https://bugbountylibrary.com/r/h1%3A137502
- Tags: area:web domain:web impact:data-leak impact:integrity kind:bounty platform:hackerone sev:high technique:source-review vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** vimeo.com video share Ajax endpoint and player.vimeo.com config endpoint
**Root cause:** The ?action=share Ajax endpoint returns an error message containing the player config URL with its s=[SECRET] token even when the requester lacks access to the private video; the config endpoint trusts that token without re-checking access rights.
**Steps:**
1. Send `GET https://vimeo.com/[VIDEO_ID]?action=share` with header `X-Requested-With: XMLHttpRequest` for a private VIDEO_ID you cannot access.
2. Read the error response, which contains the config URL `https://player.vimeo.com/video/[VIDEO_ID]/config?...&s=[SECRET]`.
3. Request that config URL with the leaked `s` token to obtain video file links, title, owner, etc.
4. Play/download the private video without being logged in.
**How found:** Researcher inspected the Ajax share endpoint's behavior for inaccessible videos and noticed the error response still embedded the config URL including the secret s token, then tested whether that token alone granted config access.
**Exploitation:** Unauthenticated attacker substitutes any private VIDEO_ID into the share Ajax request, harvests the leaked s token from the error body, then loads the config endpoint to retrieve direct video file links and metadata, giving full access to the private video.
**Insight:** Error responses from Ajax endpoints often echo internal resource URLs with embedded access tokens; check whether those tokens are honored independently by the downstream config/media endpoint without a separate authorization check.