Description
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo CreatePlugin template for list.json.php does not include any authentication or authorization check. While the companion templates add.json.php and delete.json.php both require admin privileges, the list.json.php template was shipped without this guard. Every plugin that uses the CreatePlugin code generator inherits this omission, resulting in 21 unauthenticated data listing endpoints across the platform. These endpoints expose sensitive data including user PII, payment transaction logs, IP addresses, user agents, and internal system records. At time of publication, there are no publicly available patches.
Published: 2026-03-31
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Data Exposure
Action: Apply Workaround
AI Analysis

Impact

In AVideo up to version 26.0 the CreatePlugin list.json.php template lacks an authentication guard, allowing any user to access 21 endpoints that return full plugin listings. These listings expose user PII, payment transaction logs, IP addresses, user agents, and internal system records, enabling attackers to obtain sensitive information without authorization.

Affected Systems

The flaw affects the WWBN AVideo open‑source video platform, specifically versions 26.0 and earlier. Any plugin generated by CreatePlugin inherits the missing guard, creating 21 unauthenticated data‑listing endpoints across the platform.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity while an EPSS score of less than 1 % suggests the risk of exploitation is currently low. The vulnerability is not in CISA’s KEV catalog. Attackers can exploit the flaw simply by sending HTTP requests to the unsecured endpoints, making the attack straightforward and requiring no credentials. With no public patch yet available, the risk persists until a vendor fix is released or mitigated by controls.

Generated by OpenCVE AI on April 2, 2026 at 04:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Configure the web server or reverse proxy to require authentication for the affected URLs, effectively blocking unauthenticated access.
  • Monitor access logs for requests to the 21 endpoints to detect and investigate potential abuse.
  • Check WWBN’s website or GitHub for an official patch or update, and apply it as soon as it is available.
  • If an immediate patch is unavailable, consider removing or disabling the vulnerable endpoints from the deployment until a fix is applied.

Generated by OpenCVE AI on April 2, 2026 at 04:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-g2mg-cgr6-vmv7 AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints
History

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Wwbn
Wwbn avideo
CPEs cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*
Vendors & Products Wwbn
Wwbn avideo
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Apr 2026 02:15:00 +0000

Type Values Removed Values Added
Description WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo CreatePlugin template for list.json.php does not include any authentication or authorization check. While the companion templates add.json.php and delete.json.php both require admin privileges, the list.json.php template was shipped without this guard. Every plugin that uses the CreatePlugin code generator inherits this omission, resulting in 21 unauthenticated data listing endpoints across the platform. These endpoints expose sensitive data including user PII, payment transaction logs, IP addresses, user agents, and internal system records. At time of publication, there are no publicly available patches.
Title AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Wwbn Avideo
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-04-01T13:38:51.374Z

Reserved: 2026-03-30T18:41:20.754Z

Link: CVE-2026-34732

cve-icon Vulnrichment

Updated: 2026-04-01T13:38:41.764Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-31T21:16:31.910

Modified: 2026-04-01T18:38:07.460

Link: CVE-2026-34732

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-02T20:10:38Z

Weaknesses