CVE-2026-89248
Received Received - Intake

Missing Authentication Check in AVideo WebRTC Plugin

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: VulnCheck

Description
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json.php. When the WebRTC plugin is present, any unauthenticated remote user can request /plugin/WebRTC/status.json.php and receive JSON containing the absolute filesystem path of the WebRTC2RTMP helper binary (revealing the document-root path), the configured WebRTC port, file_exists/is_executable status for the binary, the contents of the WebRTC log/JSON files (videos/WebRTC2RTMP.log) when present, and whether the configured port is reachable on loopback (127.0.0.1) and on the public address. The endpoint performs no User::isLogged(), User::isAdmin(), or forbiddenPage() check. The issue was unfixed at the time of reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89248
EUVD
EUVD-2026-76060

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
avideo avideo *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-89248 is an information disclosure vulnerability in AVideo's WebRTC plugin. The status.json.php file lacks authentication checks, allowing unauthenticated remote users to access sensitive data. This includes filesystem paths, WebRTC port details, binary status, log file contents, and port reachability on loopback or public addresses.

Detection Guidance

To detect this vulnerability, check if the WebRTC plugin is installed and if the endpoint /plugin/WebRTC/status.json.php is accessible without authentication. Use curl to request the endpoint and inspect the response for sensitive information like filesystem paths or port details. Example command: curl -v http://<target>/plugin/WebRTC/status.json.php

If the response includes absolute paths, port status, or log file contents, the system is vulnerable. Ensure the endpoint is not publicly accessible or requires authentication.

Impact Analysis

This vulnerability allows attackers to gather sensitive system information without authentication. They can learn internal paths, check if critical files exist, read log contents, and determine port accessibility. This information could aid further attacks like privilege escalation or targeted exploits.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protecting personal data, while HIPAA mandates securing protected health information. The exposure of filesystem paths and log contents could lead to compliance breaches and regulatory penalties.

Mitigation Strategies

Immediately restrict access to the /plugin/WebRTC/status.json.php endpoint by implementing authentication checks such as User::isAdmin(). Alternatively, remove the WebRTC plugin if not needed. Update to the latest version if a patch is available.

Ensure the endpoint is not exposed to unauthenticated users and monitor logs for suspicious access attempts to the vulnerable path.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89248. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart