Executive brief
WWBN AVideo, an open-source video hosting platform, contains a security flaw in a diagnostic script that remains accessible after installation. This allows unauthorized individuals to view sensitive viewer data, including IP addresses, session IDs, and browser information. Exposure of this data could lead to privacy violations and provide attackers with information useful for further targeted attacks.
Technical details
An information disclosure vulnerability exists in WWBN AVideo versions 26.0 and prior due to a disabled security check in the 'install/test.php' diagnostic script. The script's command-line interface (CLI) guard was intentionally commented out, allowing the script to be executed via HTTP by unauthenticated remote actors. When accessed, the script calls 'VideoStatistic::getLastStatistics()' and uses 'var_dump()' to output sensitive viewer metadata, including IP addresses, session IDs, and user agents. Additionally, the script enables verbose error reporting, which can leak internal filesystem paths. To remediate this, administrators should uncomment the 'die()' statement in the CLI guard or remove the 'install/' directory entirely.
Affected products
- WWBN AVideo <= 26.0
Timeline
- 2026-04-02: advisory: GitHub Security Advisory published by vendor
- 2026-04-06: disclosed: CVE published to NVD