CVE-2026-35450
Received Received - Intake
Unauthorized Access in WWBN AVideo FFmpeg Plugin Endpoint

Publication date: 2026-04-06

Last updated on: 2026-04-14

Assigner: GitHub, Inc.

Description
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints (kill.ffmpeg.json.php, list.ffmpeg.json.php, ffmpeg.php) require User::isAdmin().
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-06
Last Modified
2026-04-14
Generated
2026-06-16
AI Q&A
2026-04-07
EPSS Evaluated
2026-06-15
NVD
CVE-2026-35450
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
wwbn avideo to 26.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Impact Analysis

The vulnerability allows unauthenticated users to probe the FFmpeg remote server configuration and retrieve connectivity status information. While it does not allow modification or disruption of the service, it can expose sensitive configuration details that could be used to plan further attacks or reconnaissance. The CVSS score of 5.3 indicates a medium severity with low attack complexity and no privileges required.

Executive Summary

This vulnerability exists in WWBN AVideo, an open source video platform, in versions 26.0 and prior. The issue is that the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without requiring any authentication. This means anyone can access this endpoint and obtain information about the FFmpeg server configuration. In contrast, other related FFmpeg management endpoints require administrator privileges.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-35450. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart