# Watch any Password Video without password

Password-protected Vimeo videos could be liked via the player config/like endpoints without the password, then viewed in Couchmode which skipped the password check.

- Payout: hidden
- Severity: medium
- Program: Vimeo
- Found by: opnsec
- Disclosed: 2017-10-18
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/155618
- Library page: https://bugbountylibrary.com/r/h1%3A155618
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:medium vuln:access-control vuln:auth-bypass vuln:business-logic

**Target:** Vimeo player config/like endpoints and Couchmode viewer
**Root cause:** The player config and like endpoints did not require the video password, and Couchmode served liked/watch-later videos without re-checking the password.
**Steps:**
1. Be logged in to Vimeo.
2. Fetch `https://player.vimeo.com/video/[VIDEO_ID]/config` without the password to obtain session, signature and timestamp tokens.
3. POST those tokens to `https://player.vimeo.com/video/[VIDEO_ID]/like` to like the passworded video (same flaw with watch_later).
4. Open the liked video in Couchmode, which plays it without asking for the password.
**How found:** Noticed the player config endpoint returned like tokens without a password, and that Couchmode trusted the liked state without re-checking the password.
**Exploitation:** Attacker likes a passworded video using tokens from the unauthenticated config endpoint, then views it via Couchmode which omits the password prompt, bypassing protection.
**Insight:** When a resource has a password gate, check every secondary endpoint (config, like, watch-later) and alternate viewers (Couchmode) that trust derived state like 'liked' rather than re-validating the gate.