PT-2026-37301 · Wwbn · Avideo

Tronglinh23 · Published 2026-05-05 · Updated 2026-05-12 · CVE-2026-43885

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to 29.1

Description An unauthenticated user can access the public endpoint "objects/plugins.json.php" to read the APISecret from the plugin object data. This secret can then be used to authenticate requests to the protected API endpoint "plugin/API/get.json.php" by providing it via the APISecret parameter, allowing unauthorized access to protected data such as the users list via the APIName parameter.

Recommendations Update to the version containing commit 1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b. Require administrator authentication for the full plugin inventory and configuration endpoint.

Exploit

Fix

Information Disclosure

Missing Authorization

Weakness Enumeration

CWE-200

CWE-862

Related Identifiers

CVE-2026-43885

GHSA-XR49-F4RH-QCJF

Affected Products

Avideo

References · 8

• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-xr49-f4rh-qcjf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-43885 · Security Note
• https://osv.dev/vulnerability/GHSA-xr49-f4rh-qcjf · Vendor Advisory
• https://github.com/WWBN/AVideo/commit/1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b · Note
• https://github.com/WWBN/AVideo · Note
• https://t.me/CVEtracker/53416 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1t5dfkb/resumen_diario_de_vulnerabilidades_06052026 · Reddit Post
• https://twitter.com/VulmonFeeds/status/2054007788775284965 · Twitter Post