Executive brief
WWBN AVideo is an open-source platform used for hosting and managing video content. A security flaw in the platform's plugin development system has left 21 different data endpoints unprotected, allowing anyone on the internet to access sensitive information without a password. This exposed data includes user personal information, payment transaction logs from PayPal and Authorize.Net, IP addresses, and internal system records, which could lead to significant privacy breaches and financial data exposure.
Technical details
A vulnerability exists in the WWBN AVideo 'CreatePlugin' code generation template, specifically within the 'list.json.php' component. While sibling templates for adding or deleting data correctly implement 'User::isAdmin()' checks, the listing template was distributed without any authentication or authorization guards. Because this template is used to scaffold CRUD operations for various plugins, the omission was inherited by at least 21 different endpoints. An unauthenticated attacker can send simple GET requests to these endpoints to retrieve JSON-formatted data including PayPal/Authorize.Net transaction logs, user connection graphs, and meeting join logs (containing IPs and User Agents). As of the advisory date, no official patches are available, and manual remediation involves adding admin checks to the affected PHP files.
Affected products
- WWBN AVideo <= 26.0
Timeline
- 2026-03-30: advisory: GitHub Security Advisory published by maintainers
- 2026-03-31: disclosed: NVD publication date