WWBN AVideo is a free video platform. In version 29.0 and earlier, the script objects/mention.json.php does not enforce user authentication or administrative gating. The only checks are a very loose regular expression on the request term and a hard‑coded row count of 10. This omission allows an unauthenticated user to query the endpoint and receive up to ten matching usernames, thereby enumerating valid users without any login. The effect is a clear information disclosure that could aid attackers in subsequent phishing or credential‑guessing attacks.

The vulnerability affects WWBN AVideo versions 29.0 and earlier. The issue is tied to the mention endpoint found in objects/mention.json.php. Users running any of these versions should consider themselves potentially exposed.

The CVSS score of 5.3 classifies the flaw as a moderate severity vulnerability. Although the EPSS score is not provided, the absence of authentication means an attacker can exploit the flaw with minimal effort, provided the endpoint is network reachable. It is not currently listed in the CISA KEV catalog, but the impact of knowing valid user accounts grants an attacker a foothold for further social‑engineering or credential‑based attacks. The most straightforward attack vector is an unauthenticated HTTP request to the mention endpoint, which may be especially dangerous if the platform is exposed to public traffic.