Which versions of AVideo are affected by CVE-2026-43885?

AVideo versions 29.0 and earlier contain a critical authentication bypass vulnerability that exposes API secrets to unauthenticated attackers through a publicly accessible configuration endpoint,…. A patch is available.

How to fix or mitigate CVE-2026-43885?

Within 24 hours: Identify all AVideo instances running version 29.0 or earlier in your environment and restrict network access to objects/plugins.json.php endpoint via web application firewall or network controls. Within 7 days: Upgrade to the patched version available from AVideo upstream (verify commit 1c36f229 or later); if unavailable, apply temporary authentication requirement to the plugins.json.php endpoint at the application server level. Within 30 days: Conduct complete audit of API activity logs from deployment date to identify unauthorized access attempts; reset all API secrets and review all user enumeration activities; confirm patch deployment across all instances with version verification.

AVideo CVE-2026-43885

Q: What is the CVSS score of CVE-2026-43885?

CVE-2026-43885 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

Information Exposure (CWE-200)

2026-05-05 https://github.com/WWBN/AVideo

GHSA-xr49-f4rh-qcjf

Authentication Bypass PHP Information Disclosure

7.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 11, 2026 - 22:37 vuln.today

cvss_changed

CVSS changed

May 11, 2026 - 22:37 NVD

7.7 (HIGH)

Source Code Evidence Fetched

May 05, 2026 - 23:01 vuln.today

Analysis Generated

May 05, 2026 - 23:01 vuln.today

DescriptionGitHub Advisory

Summary

An unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints (e.g. users_list) without logging in.

Details

objects/plugins.json.php is public and still exposes plugin object_data containing APISecret. That secret is accepted by plugin/API/get.json.php as authentication.

PoC

Get plugin config (contains APISecret):

bash

  curl 'http://<host>/objects/plugins.json.php'

Copy APISecret from response, then call API directly:

bash

  curl --get 'http://<host>/plugin/API/get.json.php' \
    --data-urlencode 'APIName=users_list' \
    --data-urlencode 'APISecret=<APISecret>' \
    --data-urlencode 'rowCount=3' \
    --data-urlencode 'current=1'

Impact

Unauthenticated disclosure of sensitive config (APISecret) leading to unauthorized access to protected API data.

Recommended fix

Requiring admin auth for full plugin inventory/config endpoint.

AnalysisAI

AVideo version 29.0 and earlier exposes API authentication secrets (APISecret) to unauthenticated remote attackers via a publicly accessible plugin configuration endpoint at objects/plugins.json.php. This vulnerability enables complete bypass of authentication controls protecting sensitive API endpoints including user enumeration (users_list) and other privileged operations. Publicly available exploit code exists (proof-of-concept demonstrated in GitHub advisory GHSA-xr49-f4rh-qcjf). Upstream fix available via commit 1c36f229 but no tagged release version has been independently confirmed at time of analysis.

Technical ContextAI

AVideo is a PHP-based video sharing platform (composer/wwbn/avideo). The vulnerability stems from CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) in the plugin configuration disclosure endpoint. The file objects/plugins.json.php returns full plugin metadata including the object_data field containing APISecret values without requiring authentication. The plugin/API/get.json.php endpoint accepts this APISecret as a credential to bypass normal session-based authentication. The root cause is the plugin inventory endpoint returning complete configuration objects instead of filtering sensitive fields before disclosure. The commit diff shows the fix sanitizes object_data by explicitly clearing it before JSON serialization when serving public requests. This represents a classic information disclosure → privilege escalation chain where leaked credentials enable lateral movement to protected API surfaces.

RemediationAI

Apply the upstream fix from commit 1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b available at https://github.com/WWBN/AVideo/commit/1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b which strips the object_data field from plugin configuration responses. As no tagged release version incorporating this fix has been confirmed, manual patching is required: either apply the commit directly or manually modify objects/plugins.json.php to clear the object_data field before JSON encoding. The diff shows a targeted two-line change to the array sanitization logic. If immediate patching is not feasible, implement compensating controls by restricting network access to objects/plugins.json.php to authenticated admin sessions only via web server access controls (e.g., location-based authentication in nginx or .htaccess rules in Apache). Note that blocking this endpoint may break legitimate plugin discovery features for authenticated users - test thoroughly. Additionally, rotate all exposed APISecret values after remediation since any previously disclosed secrets remain valid credentials until regenerated through the AVideo admin interface. Verify the fix by testing the POC curl command after patching - objects/plugins.json.php should no longer return object_data contents.