Unauthenticated User Data Exposure in WWBN AVideo Open Source Video Platform
CVE-2026-43881

5.3MEDIUM

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
11 May 2026

What is CVE-2026-43881?

The WWBN AVideo platform, an open-source video hosting solution, has a critical security vulnerability in versions up to and including 29.0. Two unauthenticated paths in the objects/users.json.php file allow attackers to disclose sensitive user information. By manipulating the isCompany request parameter, non-admin users—including unauthenticated visitors—can bypass permission checks, granting them access to registered user accounts. This weakness enables the retrieval of detailed user profiles, including user IDs, display names, channel URLs, profile images, status, and the overall count of registered accounts. Additionally, a second endpoint enables direct access to user information by user ID without proper permission verification. This vulnerability poses a significant risk to user privacy and requires immediate attention, as noted in the recent patch commit that addresses these issues.

Affected Version(s)

AVideo <= 29.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-6...
x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/d9cdc702481a626b15f...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.