Executive brief
WWBN AVideo is an open-source platform used for hosting and managing video content. A security flaw allows unauthorized individuals to access internal configuration details regarding the video processing (FFmpeg) servers. While this does not directly expose user videos, it provides attackers with technical details about the system's internal architecture that could be used to plan more sophisticated attacks.
Technical details
A missing authentication vulnerability (CWE-306) exists in the 'plugin/API/check.ffmpeg.json.php' endpoint of WWBN AVideo. Unlike its sibling management endpoints which require administrative privileges, this specific script lacks any access control checks (such as User::isAdmin()). An unauthenticated remote attacker can query this endpoint to determine if the platform uses a standalone FFmpeg server and verify its connectivity status. This information disclosure aids in infrastructure reconnaissance. The vulnerability is present in versions 26.0 and earlier; a recommended fix involves adding an 'isAdmin' check after the configuration file is loaded.
Affected products
- WWBN AVideo <= 26.0
Timeline
- 2026-04-02: advisory: GitHub Security Advisory published by maintainer
- 2026-04-06: disclosed: CVE published to NVD