What is the CVSS score of CVE-2026-35450?

CVE-2026-35450 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-35450

MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-04-04 https://github.com/WWBN/AVideo

GHSA-2vg4-rrx4-qcpq

PHP Authentication Bypass

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 04, 2026 - 06:30 vuln.today

CVE Published

Apr 04, 2026 - 06:16 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

Summary

The plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints (kill.ffmpeg.json.php, list.ffmpeg.json.php, ffmpeg.php) require User::isAdmin().

Details

The entire file at plugin/API/check.ffmpeg.json.php:

php

<?php
$configFile = __DIR__.'/../../videos/configuration.php';
require_once $configFile;
header('Content-Type: application/json');

$obj = testFFMPEGRemote();

die(json_encode($obj));

No User::isAdmin(), User::isLogged(), or any access control check exists.

Compare with sibling endpoints in the same directory:

kill.ffmpeg.json.php checks User::isAdmin()
list.ffmpeg.json.php checks User::isAdmin()

Proof of Concept

bash

curl "https://your-avideo-instance.com/plugin/API/check.ffmpeg.json.php"

Returns information about whether the platform uses a standalone FFmpeg server and its current reachability.

Impact

Infrastructure reconnaissance revealing the encoding architecture. Limited direct impact but aids targeted attack planning.

Recommended Fix

Add an admin authentication check at plugin/API/check.ffmpeg.json.php:3, after require_once $configFile;:

php

if (!User::isAdmin()) {
    forbiddenPage('Admin only');
}

--- *Found by aisafe.io*

AnalysisAI

Unauthenticated access to FFmpeg server configuration endpoint in AVideo allows remote attackers to probe infrastructure details and determine encoding architecture without authentication, while sibling management endpoints properly enforce admin-only access. This information disclosure aids reconnaissance for targeted attacks against video encoding infrastructure. CVSS 5.3, no public exploit code identified, no active exploitation confirmed.

Technical ContextAI

AVideo is a PHP-based video platform (Composer package wwbn_avideo) that supports remote FFmpeg server configurations for distributed video encoding. The vulnerable endpoint plugin/API/check.ffmpeg.json.php calls testFFMPEGRemote() to verify connectivity to a standalone FFmpeg server without implementing access control checks. The root cause (CWE-306: Missing Authentication for Critical Function) stems from inconsistent security controls across related endpoints - sibling files kill.ffmpeg.json.php and list.ffmpeg.json.php correctly invoke User::isAdmin() checks, but check.ffmpeg.json.php omits this validation entirely. The endpoint returns JSON-encoded server reachability and configuration status that should be restricted to administrators.

RemediationAI

Apply the vendor-released patch by upgrading AVideo to the patched version specified in advisory GHSA-2vg4-rrx4-qcpq at https://github.com/advisories/GHSA-2vg4-rrx4-qcpq. The fix requires adding an authentication check to plugin/API/check.ffmpeg.json.php immediately after the require_once statement: if (!User::isAdmin()) { forbiddenPage('Admin only'); }. Alternatively, restrict network access to plugin/API/check.ffmpeg.json.php at the web server or firewall level pending patch deployment. Review other API endpoints in plugin/API/ for similar missing authentication checks using the pattern of sibling endpoints as a reference.