CVE-2026-35449: WWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-06 · updated 2026-07-24
Weakness: CWE-200

Description

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the install/test.php diagnostic script has its CLI-only access guard disabled by commenting out the die() statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP addresses, session IDs, and user agents to unauthenticated visitors.

Affected products

WWBN AVideo: through 26.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-hg8q-8wqr-35xx
https://github.com/WWBN/AVideo/security/advisories/GHSA-hg8q-8wqr-35xx

Get alerted when CVE-2026-35449 or the next vulnerability affects your stack