CVE-2026-43873
Information Disclosure in WWBN AVideo
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wwbn | avideo | 29.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-209 | The product generates an error message that includes sensitive information about its environment, users, or associated data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in WWBN AVideo, an open source video platform, in versions up to and including 29.0. The issue is in the plugin/CloneSite/cloneClient.json.php file, which unintentionally exposes the local CloneSite shared secret (myKey) in the HTTP response body on every unauthenticated request. This shared secret is a constant derived from system paths and salts. Although the code was intended to reject unauthorized access, it leaks this secret in the error message before terminating the request.
If the victim has CloneSite configured with a remote cloneSiteURL (a common setup for federation or backup), the leaked myKey acts as a credential that allows an attacker to authenticate to the remote server's cloneServer.json.php. This enables the attacker to impersonate the victim and trigger a full mysqldump of the remote server's database, which is then stored in the remote server's public videos/clones/ directory.
How can this vulnerability impact me? :
This vulnerability can have serious impacts including unauthorized disclosure of sensitive data. An attacker can obtain the shared secret key without authentication, allowing them to impersonate the victim on a remote CloneSite server.
By exploiting this, the attacker can trigger a full database dump (mysqldump) of the remote server, exposing potentially sensitive information stored in the database. This data is then publicly accessible in the remote server's videos/clones/ directory, leading to data leakage and potential compromise of user privacy and system integrity.