Executive brief
AVideo's WebRTC plugin includes an unauthenticated endpoint that exposes sensitive system information to any remote user. The endpoint discloses the server's filesystem path, configured WebRTC port, binary status, and port reachability details, allowing attackers to map the application's infrastructure without any login credentials. This information disclosure could facilitate further attacks by revealing system paths and service availability.
Technical details
The vulnerability is a missing authentication/authorization check (CWE-862) in the /plugin/WebRTC/status.json.php endpoint. The file includes configuration and directly outputs JSON data containing the absolute filesystem path of the WebRTC2RTMP binary, the configured WebRTC port number, file existence/executable status, WebRTC log contents (videos/WebRTC2RTMP.log), and results of internal/external port accessibility probes on loopback (127.0.0.1) and the public address. The endpoint performs no User::isLogged(), User::isAdmin(), or forbiddenPage() authorization checks, allowing any unauthenticated network user to request it. The vulnerability is present when the WebRTC plugin is installed and enabled. No patch was available at the time of reporting; the fix requires adding authentication or removing the endpoint from the web-accessible tree.
Affected products
- WWBN AVideo <= c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-27: disclosed
- 2026-09-11: advisory