CVE-2026-34732
Unauthenticated Data Exposure in WWBN AVideo CreatePlugin
Publication date: 2026-03-31
Last updated on: 2026-04-01
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wwbn | avideo | to 26.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability exposes sensitive data including user personally identifiable information (PII), payment transaction logs, IP addresses, user agents, and internal system records through unauthenticated data listing endpoints.
Exposure of such sensitive information can lead to non-compliance with data protection regulations and standards such as GDPR and HIPAA, which require strict controls on access to personal and payment data.
Because the vulnerability allows unauthenticated access to sensitive data, organizations using affected versions of WWBN AVideo may be at risk of violating these regulations due to inadequate access controls and potential data breaches.
Can you explain this vulnerability to me?
The vulnerability exists in WWBN AVideo, an open source video platform, specifically in versions 26.0 and prior. The issue is that the AVideo CreatePlugin template for list.json.php does not include any authentication or authorization checks. While other related templates require admin privileges, this one does not, allowing unauthenticated access.
As a result, every plugin using the CreatePlugin code generator inherits this flaw, leading to 21 unauthenticated data listing endpoints across the platform.
These endpoints expose sensitive data such as user personally identifiable information (PII), payment transaction logs, IP addresses, user agents, and internal system records.
How can this vulnerability impact me? :
This vulnerability can have significant impacts because it allows unauthenticated users to access sensitive information without any restrictions.
- Exposure of user personally identifiable information (PII).
- Access to payment transaction logs, which could lead to financial data leaks.
- Exposure of IP addresses and user agents, which can be used for tracking or profiling users.
- Access to internal system records, potentially aiding further attacks or exploitation.
Overall, this can lead to privacy violations, data breaches, and increased risk of further security compromises.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability exists because the list.json.php template in the AVideo CreatePlugin does not require authentication or authorization, exposing sensitive data through unauthenticated endpoints.
Since there are no publicly available patches at the time of publication, immediate mitigation steps include restricting access to the affected endpoints by implementing network-level controls such as firewall rules or web application firewall (WAF) rules to block or limit access to list.json.php and related endpoints.
Additionally, consider disabling or removing plugins that use the vulnerable CreatePlugin code generator until a patch or fix is available.
Monitoring and auditing access logs for suspicious or unauthorized access attempts to these endpoints can also help in early detection and response.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending unauthenticated HTTP GET requests to the known list.json.php endpoints of the WWBN AVideo platform and its plugins. If these endpoints respond with HTTP 200 status codes and return sensitive data without requiring authentication, the system is vulnerable.
To detect the vulnerability, you can scan plugin directories for accessible list.json.php files and check their responses.
Example commands to detect the vulnerability include:
- Using curl to test a specific endpoint: curl -i http://target-site/plugin-directory/list.json.php
- Using a tool like wget: wget --spider http://target-site/plugin-directory/list.json.php
- Using a web vulnerability scanner or a custom script to enumerate all plugin directories and send unauthenticated GET requests to list.json.php endpoints, checking for HTTP 200 responses and data leakage.