The vulnerability resides in the CloneSite plugin of WWBN AVideo. Versions up to and including 29.0 contain a code path that, when an unauthenticated request is made to cloneClient.json.php, echoes the local CloneSite shared secret ($objClone->myKey). This secret is a constant md5 hash of the system root path and salt, and acts as the credential for the remote clone server. By exposing this value the application violates confidentiality, as attackers can obtain the authentication key and impersonate the legitimate user on the remote cloneSiteURL. Once authenticated, the attacker can invoke cloneServer.json.php on the remote server to trigger a full mysqldump, whose output is written to the remote public videos/clones/ directory. The result is a complete database dump that can be accessed publicly, exposing all user data, configuration, and potentially credentials.

The affected vendor is WWBN; the product is AVideo, specifically the CloneSite plugin interface. All released versions through 29.0 are impacted. Systems that have CloneSite configured with a remote cloneSiteURL for federation or backup are at risk, as the leaked key can be used to authenticate to the remote site.

The vulnerability carries a CVSS score of 7.5, indicating a high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires only the ability to send an unauthenticated request to the vulnerable endpoint, making it relatively easy for an attacker with network access to the vulnerable instance. Once the secret is disclosed, the attacker can remotely dump the database on the configured clone server. No additional privileges or complex conditions are required beyond reaching the affected URL.