The vulnerability allows an attacker to trigger the application’s full initialization sequence via the install/checkConfiguration.php endpoint, which is accessible without authentication. By submitting a crafted POST request, the attacker can set the database connection, create a user account, and write configuration files, effectively installing the application under attacker-controlled credentials. Once installed, the attacker gains complete administrative privileges over the video platform, with the ability to manage users, content, and underlying configurations. This reflects a breach of confidentiality, integrity, and availability of all platform data.

Vulnerable versions include WWBN AVideo 25.0 and earlier. The issue applies to all installations that have not yet completed the initial setup, as the sole protection is the existence of videos/configuration.php. The problem has been resolved in version 26.0, which removes this unchecked initialization pathway.

The CVSS score of 8.1 categorizes this flaw as high severity, and the EPSS score of less than 1% indicates that exploitation is currently unlikely but the potential impact is severe. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can exploit it remotely by sending an unauthenticated POST request to install/checkConfiguration.php on an uninitialized server, which the platform exposes publicly in default deployments. This access path does not require any authentication or user interaction beyond making the HTTP request, making it a straightforward risk for sites that expose the installer in production.