AAvidio-Encoder lacks a global authentication layer before release 8.1.0. Unauthenticated callers can access PHP endpoints such as view/run.php, view/queue.json.php, view/status.php, and view/listFiles.json.php. These endpoints invoke privileged functions that drive the queue processor, read memory statistics, and enumerate media file names and paths in any directory readable by the web‑server process. The exposed functionality enables an attacker to manipulate the encoder’s queue and gather system information, although the description does not indicate arbitrary command execution.

The affected product is WWBN AVideo‑Encoder. All releases prior to version 8.1.0 are impacted. The vendor has released a fix in release v8.1.0.

The CVSS score of 7.3 reflects a high severity risk. EPSS is not available and the vulnerability is not listed in CISA KEV. The likely attack vector is unauthenticated HTTP requests to the exposed PHP endpoints. Because the endpoints lack authentication and the functions exposed normally require privileged access, an attacker with network reach can manipulate the encoder’s queue, observe memory usage, and enumerate files. While arbitrary system‑level code execution is not explicitly described, the combination of privileged processing with uncontrolled input can lead to significant information disclosure and potential escalation of privileges for the web‑server user.