Riskcovery

CVE-2026-43885

WWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization

State
Published
Severity
7.7 High
Published
May 11, 2026
Updated
May 15, 2026
Reserved
May 4, 2026

Read the record on cve.org

Description

WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints (e.g. users_list) without logging in. Commit 1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b contains an updated fix.

Scores

CVSSScoreVectorSource
4.07.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:PGitHub_M

Weaknesses

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-862 Missing Authorization

Affected Products

ProductVersions
AVideoWWBN
  • <= 29.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.