CVE-2026-43873: WWBN AVideo sensitive information disclosure in CloneSite plugin

Executive brief

AVideo is an open-source video platform. A vulnerability in its CloneSite plugin allows any unauthorized person to view a secret key used for site synchronization. An attacker can use this key to trick a connected backup server into creating and exposing a full copy of its database, which contains sensitive information like user passwords and payment records.

Technical details

An information disclosure vulnerability exists in `plugin/CloneSite/cloneClient.json.php` due to the improper handling of the `$argv` global in web environments. When an unauthenticated request is made, the script fails a key check and echoes the expected `$objClone->myKey` secret in the error response. This key is a static MD5 hash used to authenticate the client to a remote federation/backup server. An attacker can use the leaked key to call `cloneServer.json.php` on a remote server, triggering an unconditional `mysqldump` that is saved to a publicly accessible directory. This allows for full database exfiltration, including user credentials and configuration data.

Affected products

• WWBN AVideo <= 29.0

Timeline

• 2026-05-05: advisory: Advisory published on GitHub

References

• https://api.github.com/users/offset
• https://github.com/offset
• https://api.github.com/users/offset/gists%7B/gist_id%7D
• https://api.github.com/users/offset/repos
• https://avatars.githubusercontent.com/u/114768995?v=4
• https://api.github.com/users/offset/events%7B/privacy%7D