Executive brief
WWBN AVideo is a video management platform whose MobileManager plugin exposes sensitive system configuration data to anyone on the internet without requiring authentication. An attacker can retrieve TLS private key file paths, socket configuration, version information, and debug flags, which can be used to plan more sophisticated attacks against the platform and its infrastructure.
Technical details
The vulnerability is an information disclosure (CWE-200) in the plugin/MobileManager/getConfiguration.json.php endpoint. The endpoint fails to authenticate requests and directly echoes the entire MobileManager configuration object, including sensitive fields such as YPTSocket.server_key_file, server_crt_file, host, port, uri, and debugSocket. No authentication or authorization checks are required; an attacker can send an unauthenticated GET request over the network to retrieve this data. The impact is confidentiality loss—exposure of TLS certificate paths, internal network configuration, and debug settings that facilitate reconnaissance. A sibling endpoint (plugin/MobileYPT/getConfiguration.json.php) explicitly redacts these fields, confirming the omission was unintentional. No patch has been released as of the advisory publication date.
Affected products
- WWBN AVideo through 30.0
Timeline
- 2026-08-18: advisory: GitHub Security Advisory GHSA-5jfh-mcm7-299m published
- 2026-09-01: disclosed: CVE-2026-84481 published on NVD