Access Control Vulnerability in AVideo Encoder by WWBN

CVE-2026-61571

What is CVE-2026-61571?

AVideo, a prominent video-sharing platform, suffers from a significant access control vulnerability in its encoder functionality. Before version 8.1.0, the encoder does not implement a comprehensive authentication layer, granting unauthenticated users access to sensitive PHP endpoints. For instance, the view/run.php script, which allows for the invocation of encoder processing, and view/queue.json.php, which reveals streamer URLs, can be accessed without proper authentication. Moreover, the status.php endpoint provides memory statistics and processing triggers, exacerbating the risk of unauthorized data exposure. This vulnerability allows attackers to manipulate the queue processor, obtain sensitive queue information, and enumerate media file names and paths from directories accessible to the web server user. The issue has been addressed in version 8.1.0, underscoring the importance of updating to mitigate potential risks.

References