WWBN AVideo CVE-2026-85156

No special conditions - remote unauthenticated exploitation against default configurations of WWBN AVideo where the channel page is publicly reachable. The vulnerability is triggered by any HTTP request to the channel endpoint and does not require the attacker to hold an account, authenticate, or interact with any UI element. Exploitation is bounded by impact: only video URLs and thumbnails are disclosed, not credentials, source code, or server data. The attacker must be able to reach the AVideo HTTP service over the network (AV:N) and must know or discover the URL of at least one AVideo channel, which is standard discoverable functionality. Deployments that are entirely firewalled or require network-layer authentication before reaching the AVideo service are not directly exposed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) accurately characterizes this as a low-complexity, unauthenticated, network-reachable disclosure with limited confidentiality impact - video URLs and thumbnails leak, but no code execution, data modification, or availability impact is present. Even a mid-sized municipal IT team in inowroclaw running AVideo for internal training or community media hosting should treat this as urgent if their unlisted content carries any sensitivity, since the attack path requires only a standard HTTP request. No EPSS score was provided, no KEV listing exists, and no public exploit code was identified, suggesting opportunistic mass exploitation is not yet occurring. However, the zero-friction exploitation prerequisites (no authentication, no special tooling, no user interaction) mean any motivated actor with knowledge of an AVideo installation can immediately enumerate protected content. The primary risk variable is content sensitivity: platforms using AVideo to protect commercially or personally sensitive video material face a meaningful breach of their confidentiality model, while installations containing only genuinely public videos are unaffected in practice.

An unauthenticated attacker sends a standard HTTP GET request to the AVideo public channel page endpoint of any reachable AVideo installation. The response includes full URLs to videos the operator configured as unlisted and thumbnail images of member-only content, despite those visibility settings being active. No exploit tooling, credentials, or browser interaction is required - a single curl command suffices to extract the protected content references.