How I was able to see likes and dislikes count even though is hidden by victim | YouTube #3

Steps to reproduce:

Victim:

---

1. Upload video.
2. Edit video.
3. Show how many viewers like and dislike this video ---> Don't show how many viewers like and dislike this video.
4. Save.

---

Attacker:

---

1. Go to YouTube TV: https://www.youtube.com/tv
2. Change "Firefox" to "Cobalt" in the User-Agent.
3. Sign in ---> Sign in using a web browser.
4. Go to YouTube activate.
5. Enter code.
6. Open the victim video on YouTube TV: https://www.youtube.com/tv#/watch?v=victim_video_id

    Request:

[POST] https://www.youtube.com/youtubei/v1/next?t=

"videoId":"victim_video_id"

    Response:

"videoMetadataRenderer": {"title": {"simpleText": "TESTING VIDEO"}, "likesCount": {"simpleText": "victim_video_likesCount"}, "dislikesCount": {"simpleText": "victim_video_dislikesCount"}, "description": {"simpleText": "TESTING VIDEO"}

---

Will show the likes and dislikes count even though is hidden by victim.

PoC video: https://youtu.be/orS_fDduwWo


Timeline:

mm/dd/yyyy

04/12/2021 - Bug Found
04/12/2021 - Submit Report
04/13/2021 - Triaged
    Priority: P4 - P2
    Status: New - Assigned
04/15/2021 - Duplicate
    Status: Assigned - Duplicate of 147213774
    Status: Duplicate of 147213774 - Assigned
    Status: Assigned - Duplicate of 31337
04/15/2021 - Accepted
    Status: Duplicate of 31337 - Accepted
    Severity: S4 - S2
    Type: Customer Issue - Bug
XX/XX/2021 - Fixed (posted after fixed)

LinkedIn: Alessandro Rumampuk
YouTube: R,ando
Facebook: Ando
Twitter: R ando