Executive brief
WWBN AVideo is a video platform software that uses a plugin system to manage site functionality. An authentication bypass vulnerability in the TopMenu plugin allows attackers to retrieve hidden admin menu items and embedded secret access tokens without logging in, potentially exposing administrative tool URLs and sensitive query parameters that are not visible to normal users.
Technical details
The plugin/TopMenu/menuItems.json.php endpoint lacks authentication checks (missing User::isAdmin() validation) and processes POST requests with a menuId parameter to return MenuItem objects. The vulnerability stems from insufficient access control on the menu items API which exposes inactive admin menus containing hidden URLs with embedded secret query parameters. An unauthenticated attacker can POST to the endpoint with an arbitrary menuId to retrieve sensitive admin tool URLs including secrets not exposed in the public navbar. The endpoint correctly ignores GET requests but fails to authenticate POST requests. No patch has been released as of the advisory publication date.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-28: disclosed
- 2026-09-12: advisory