Information Disclosure in AVideo WebRTC Plugin by WWBN

CVE-2026-89248

What is CVE-2026-89248?

The AVideo WebRTC Plugin contains a vulnerability that allows unauthenticated users to access sensitive information through the endpoint /plugin/WebRTC/status.json.php. This endpoint exposes critical details including the absolute filesystem path of the WebRTC2RTMP helper binary, the configured WebRTC port, and execution status of the binary. Additionally, it discloses the contents of associated log files and confirms the reachability of the configured port on both loopback and public addresses. The absence of proper authentication checks such as User::isLogged() and User::isAdmin() enables unauthorized access to this information, raising serious security concerns.

References