A key‑based authentication check is omitted when the CDN plugin’s authentication key remains the default empty string. This allows any user to access the plugin endpoints plugin/CDN/status.json.php and plugin/CDN/disable.json.php without credentials. The endpoints accept a par request parameter that can be used to mass‑assign configuration values, enabling an attacker to modify the entire CDN configuration, including URLs, storage credentials, and the authentication key itself.

The vulnerability affects the WWBN AVideo video platform, specifically versions up to and including 26.0, where the CDN plugin endpoints are present.

The CVSS base score of 8.6 indicates a high severity. The EPSS score is less than 1 %, implying a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker does not need any further authentication or privileged credentials; the flaw is exploitable simply by issuing HTTP requests to the exposed plugin URLs when the CDN plugin is enabled with its default empty key.