CVE-2026-35450
Unauthorized Access in WWBN AVideo FFmpeg Plugin Endpoint
Publication date: 2026-04-06
Last updated on: 2026-04-14
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wwbn | avideo | to 26.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability allows unauthenticated users to probe the FFmpeg remote server configuration and retrieve connectivity status information. While it does not allow modification or disruption of the service, it can expose sensitive configuration details that could be used to plan further attacks or reconnaissance. The CVSS score of 5.3 indicates a medium severity with low attack complexity and no privileges required.
Can you explain this vulnerability to me?
This vulnerability exists in WWBN AVideo, an open source video platform, in versions 26.0 and prior. The issue is that the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without requiring any authentication. This means anyone can access this endpoint and obtain information about the FFmpeg server configuration. In contrast, other related FFmpeg management endpoints require administrator privileges.