The vulnerability allows an unauthenticated user to read the APISecret value from the objects/plugins.json.php endpoint and use that secret to call protected API endpoints such as users_list without logging in. This results in unauthorized disclosure of sensitive data and potentially further exploitation of privileged operations. The weakness originates from missing authorization checks on the API endpoint and inadequate protection of secret data.

The flaw affects WWBN AVideo versions up to and including 29.0. Any deployment running these versions without applying the commit 1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b introduces the vulnerability. The affected component is the public API exposed by the objects/plugins.json.php resource.

The CVSS score of 7.7 indicates a high severity, while the EPSS score is not reported, making it unclear how frequently this vulnerability is exploited in the wild. It is not listed in CISA’s KEV catalogue. Exploitation requires only the ability to send an HTTP request to the vulnerable endpoint, and no authentication is required, making it straightforward for an attacker with network access to read the secret and perform unauthorized API calls.