Executive brief
WWBN AVideo, an open-source video sharing platform, contains a security flaw that allows anyone on the internet to see a list of registered users. By accessing a specific internal file, an unauthorized person can gather usernames and account details without needing to log in. This information could be used to facilitate more targeted attacks, such as phishing or password guessing, against the platform's users.
Technical details
An improper authorization vulnerability exists in WWBN AVideo versions 29.0 and earlier within the 'objects/mention.json.php' component. The script fails to implement 'User::loginCheck()' or any administrative access controls, relying solely on a regex check for a leading '@' character in the 'term' request parameter. This allows a remote, unauthenticated attacker to query the 'User::getAllUsers' method and retrieve sensitive user information including names, emails, and channel names. This issue is a sibling to CVE-2026-43881 and represents an incomplete fix in the codebase.
Affected products
- WWBN AVideo <= 29.0
Timeline
- 2026-05-11: advisory: GitHub Security Advisory published
- 2026-05-29: disclosed: CVE published to NVD