Unauthorized Access in WWBN AVideo FFmpeg Plugin Endpoint

Publication date: 2026-04-06

Last updated on: 2026-04-14

Assigner: GitHub, Inc.

Description

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints (kill.ffmpeg.json.php, list.ffmpeg.json.php, ffmpeg.php) require User::isAdmin().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-06

Last Modified

2026-04-14

Generated

2026-07-06

AI Q&A

2026-04-07

EPSS Evaluated

2026-07-05

NVD

CVE-2026-35450

Affected Vendors & Products

Vendor	Product	Version / Range
wwbn	avideo	to 26.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Impact Analysis

The vulnerability allows unauthenticated users to probe the FFmpeg remote server configuration and retrieve connectivity status information. While it does not allow modification or disruption of the service, it can expose sensitive configuration details that could be used to plan further attacks or reconnaissance. The CVSS score of 5.3 indicates a medium severity with low attack complexity and no privileges required.

Executive Summary

This vulnerability exists in WWBN AVideo, an open source video platform, in versions 26.0 and prior. The issue is that the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without requiring any authentication. This means anyone can access this endpoint and obtain information about the FFmpeg server configuration. In contrast, other related FFmpeg management endpoints require administrator privileges.

Hi! I’m here to help you understand CVE-2026-35450. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70