What’s Vulnerable › Vulnerabilities

CVE-2026-84481: WWBN AVideo through 30.0 Information Disclosure via MobileManager

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-01 · updated 2026-09-08
• Weakness: CWE-200

Description

WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data to unauthenticated visitors. Attackers can send an unauthenticated GET request to plugin/MobileManager/getConfiguration.json.php to obtain TLS private key file paths, socket configuration details, platform version, and debug flags enabling further targeted attacks.

Affected products

• WWBN AVideo: through 30.0

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-5jfh-mcm7-299m
• https://www.vulncheck.com/advisories/wwbn-avideo-through-30.0-information-disclosure-via-mobilemanager
• https://github.com/WWBN/AVideo/security/advisories/GHSA-5jfh-mcm7-299m

Get alerted when CVE-2026-84481 or the next vulnerability affects your stack