Executive brief
WWBN AVideo, an open-source video hosting platform, contains a security flaw in its SocialMediaPublisher plugin. This flaw allows unauthorized individuals to use the video server as a middleman to send commands to Facebook and Instagram's programming interfaces. An attacker could potentially use this to post or modify social media content using stolen credentials or by masking their identity behind the server's address.
Technical details
A missing authorization check in the SocialMediaPublisher plugin allows unauthenticated access to the 'publishInstagram.json.php' endpoint. This endpoint accepts user-controlled parameters—including access tokens, container IDs, and account IDs—and passes them directly to the Instagram Graph API via the 'InstagramUploader::publishMediaIfIsReady()' method. An attacker can exploit this to perform arbitrary Graph API calls through the server's IP address. This can be used to bypass rate limits or, if combined with leaked credentials, to manipulate social media content. As of the advisory date, no official patch has been released, but a manual fix involving adding a 'User::isAdmin()' check is recommended.
Affected products
- WWBN AVideo <= 26.0
Timeline
- 2026-04-01: advisory: GitHub Security Advisory published by maintainer
- 2026-04-06: disclosed: CVE-2026-35179 published to NVD