Avideo CVE-2026-34732

This vulnerability presents a moderate real-world risk despite its CVSS 5.3 (Medium) score. The CVSS vector indicates unauthenticated remote access (AV:N/PR:N) with low attack complexity, meaning any network-connected attacker can exploit this without credentials or user action. The exploitation probability is high because the vulnerability is systematic across 21 endpoints and affects any plugin using the CreatePlugin generator. Although EPSS data is not provided, the pattern of missing security controls in a code generator suggests high likelihood of exploitation by automated tools or targeted research. The primary limiting factor is confidentiality impact only (C:L) - no integrity or availability compromise - but the exposed data categories (PII, payment logs, IP addresses) are sensitive and could enable follow-on attacks (credential compromise, identity theft, targeted social engineering). The absence of a vendor patch at publication time elevates operational risk for administrators who cannot immediately remediate. This is not a high-CVSS-but-low-risk issue; it is a legitimate authentication bypass affecting a popular open-source platform with real-world consequences despite the moderate CVSS baseline.

An attacker discovers a public-facing WWBN AVideo instance and crafts HTTP GET requests to known plugin list.json.php endpoints (e.g., /plugin/[pluginname]/list.json.php). Because no authentication is enforced, the requests return JSON-encoded data including user records, payment transaction logs, and internal system metadata. The attacker uses the exposed PII to conduct phishing campaigns or social engineering attacks, or extracts payment information for financial fraud. No exploit code is required; simple curl or browser requests suffice. This attack requires only network access and knowledge of plugin endpoint names, making it trivial to automate across multiple AVideo instances.