# Downloading password protected / restricted videos

Vimeo's Apple TV API endpoint returned metadata and signed playback URLs for password-protected and private videos, allowing anyone to download them.

- Payout: hidden
- Severity: high
- Program: Vimeo
- Found by: gazza
- Disclosed: 2016-09-05
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/145467
- Library page: https://bugbountylibrary.com/r/h1%3A145467
- Tags: area:web domain:api impact:data-leak kind:bounty platform:hackerone sev:high tech:rest vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** Apple TV (atv) clip API endpoint /api/atv/clip/{id}
**Root cause:** The Apple TV API endpoint /api/atv/clip/{VideoID} did not enforce the video's privacy settings or password protection, returning metadata and a signed play URL to unauthenticated requests.
**Steps:**
1. Request `https://vimeo.com/api/atv/clip/171116158/` in a fresh unauthenticated browser session.
2. Observe title, subtitle and summary returned despite the video being password-protected.
3. Extract the signed play URL from the `event-handlers` load-url parameter: `https://vimeo.com/api/atv/clip/171116158/play?signature=...&timestamp=...`.
4. Visit the play URL to obtain the `media-url` Google Storage signed download link.
5. Download the file (named `550779256`, an mp4) and confirm it is the protected video.
**How found:** Researcher tested the Apple TV API endpoint in a separate unauthenticated browser to avoid existing session auth, and found it returned metadata and a signed playback URL for a password-protected video.
**Exploitation:** An unauthenticated attacker requests the ATV clip metadata endpoint for any video ID, reads the embedded signed play URL, follows it to get the Google Storage media-url, and downloads the full video file, bypassing both 'Only me' privacy and password protection.
**Insight:** Alternate-platform API endpoints (Apple TV, Roku, mobile) often lag behind the main web app's authorization checks; test each client-specific API path against private/password-protected content with a clean session.