Is CVE-2026-61571 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61571 being exploited in the wild.

How severe is CVE-2026-61571?

High severity, with a CVSS score of 7.3, published 28 October 2026.

Which products and versions are affected?

WWBN AVideo Encoder before 8.1.0.

How is CVE-2026-61571 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-61571?

Check whether you run WWBN AVideo Encoder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61571: AVideo Encoder authentication bypass in control endpoints

CVE-2026-61571 · Severity: high · CVSS 7.3 · Published 2026-10-28

AVideo Encoder is a video-processing backend that manages encoding jobs and media files. Prior to version 8.1.0, unauthenticated attackers can access administrative control endpoints over the network, allowing them to view encoding queue information, trigger job processing, enumerate media file paths, and obtain server memory statistics without any credentials.

Technologies: WWBN AVideo Encoder. Vendors: WWBN.

Quick answers

Is CVE-2026-61571 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61571 being exploited in the wild.
How severe is CVE-2026-61571?: High severity, with a CVSS score of 7.3, published 28 October 2026.
Which products and versions are affected?: WWBN AVideo Encoder before 8.1.0.
Is there a fix for CVE-2026-61571?: Yes: fixed in 8.1.0. Until then: Restrict network access to encoder control endpoints to trusted hosts only; disable bulk-encode functionality in configuration if not needed until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61571 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-61571?: Check whether you run WWBN AVideo Encoder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 8.1.0

Restrict network access to encoder control endpoints to trusted hosts only; disable bulk-encode functionality in configuration if not needed until upgrading.

Technical details

The encoder's PHP endpoints (run.php, queue.json.php, status.php, and listFiles.json.php) lack global authentication checks, allowing unauthenticated callers to invoke sensitive operations. The `listFiles.json.php` endpoint's permission check (`canBulkEncode()`) incorrectly admitted anonymous users when bulk-encode was not explicitly disabled, and accepted arbitrary directory paths via the `path` parameter, leading to enumeration of media files readable by the web server user.

Affected products

WWBN AVideo Encoder before 8.1.0

Timeline

2026-10-28: disclosed
2026-09-23: patched: version 8.1.0 released with permission checks and authentication enforcement

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.