This vulnerability exposes a fundamental misclassification: a deduplication endpoint that returns video identifiers has been leveraged as an uncontrolled authentication token dispenser. The critical failure isn't missing ownership verification in deduplicateByEncoderQueueId() — it's that this function was ever positioned to return credentials usable by useVideoHashOrLogin() without scoping to the requesting user.
The attack requires only upload permission, the lowest access tier. By omitting the videos_id parameter, an attacker triggers the endpoint to return an admin's video_id_hash, which then authenticates as that admin. The encoder queue treats all submissions as potentially belonging to any user, breaking user isolation entirely.
What makes this severe beyond the CVSS: the video_id_hash migrated from a non-sensitive tracking token to a session credential without any security review. This is a known mutation pattern — opaque handles that survive their original context and get reimported into authentication paths. The deduplication endpoint isn't just broken; it's a map revealing where other credential surfaces likely exist in the encoder queue infrastructure.
Verify your instance: check whether deduplicateByEncoderQueueId() enforces ownership validation, whether video_id_hash is used in any authentication pathways, and audit the encoder queue for similar endpoints that assume trusted caller context. The patch fixes one call path; the underlying assumption — that opaque identifiers can propagate across trust boundaries — likely infects other queue operations. Assume additional similar vulnerabilities exist in adjacent code until proven otherwise.