EUVD-2026-14506
GHSA-r64r-883r-wcwh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend unauthenticated request to CDN plugin endpoint
-
ExploitBypass empty default key validation
-
ExecutionModify CDN configuration via mass-assignment parameter
-
ImpactInject malicious CDN URLs or steal storage credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | WWBN AVideo versions up to 26.0 with CDN plugin enabled and authentication key not configured (default state). Remote unauthenticated attacker can access plugin/CDN/status.json.php and plugin/CDN/disable.json.php endpoints to modify CDN configuration via mass-assignment. |
| Impact | This represents a critical real-world risk for default installations. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L indicates network-based attacks with low complexity requiring no authentication, privileges, or user interaction. The vulnerability is highly automatable and exploitable immediately upon CDN plugin enablement in default configurations. The high integrity impact (I:H) reflects the ability to modify CDN infrastructure settings and credentials, potentially leading to content manipulation, data exfiltration via malicious CDN endpoints, or service disruption. Organizations running AVideo 26.0 or earlier with the CDN plugin enabled are immediately vulnerable. While no KEV listing or EPSS score is provided in the intelligence data, the combination of unauthenticated network access, default misconfiguration, and critical function compromise makes this a priority for immediate patching in affected deployments. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies an AVideo installation with the CDN plugin enabled through reconnaissance of the /plugin/CDN/ endpoints. The attacker sends crafted HTTP requests to plugin/CDN/status.json.php or plugin/CDN/disable.json.php without any authentication credentials, which bypasses the empty-key validation check. Using the mass-assignment capability through the 'par' parameter, the attacker modifies the CDN configuration to redirect video content through attacker-controlled CDN endpoints, exfiltrates storage credentials, or sets their own authentication key to maintain persistent administrative access to CDN settings. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 23, 2026
WWBN AVideo video platform up to and including version 26.0 contains an authentication bypass vulnerability in the CDN plugin that allows unauthenticated remote attackers to completely modify CDN configuration settings including storage credentials and authentication keys. The vulnerability stems from the CDN plugin's default empty string authentication key, which causes validation checks to be bypassed entirely when the plugin is enabled but not properly configured. The CVSS score of 8.6 reflects high integrity impact with network-based exploitation requiring no privileges or user interaction.
RemediationAI
Apply the patch available in commit adeff0a31ba04a56f411eef256139fd7ed7d4310 by upgrading to a version newer than 26.0 that includes this fix (see https://github.com/WWBN/AVideo/commit/adeff0a31ba04a56f411eef256139fd7ed7d4310 and https://github.com/WWBN/AVideo/security/advisories/GHSA-r64r-883r-wcwh). If immediate patching is not possible, disable the CDN plugin entirely if not in active use, or immediately configure a strong authentication key for the CDN plugin to prevent the bypass condition. Review CDN configuration settings for unauthorized modifications including URLs, storage credentials, and authentication keys, and implement network-level access controls to restrict access to CDN plugin endpoints to trusted IP ranges only.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects WWBN AVideo (cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*), an open-source PHP-based video streaming platform. The root cause is CWE-306 (Missing Authentication for Critical Function), where the CDN plugin endpoints plugin/CDN/status.json.php and plugin/CDN/disable.json.php implement key-based authentication but default to an empty string as the authentication key. When administrators enable the CDN plugin without explicitly configuring a custom key, the validation logic is completely bypassed because the empty default key matches the uninitialized state. The vulnerability is compounded by mass-assignment through the 'par' request parameter, allowing attackers to modify arbitrary CDN configuration properties including URLs, storage credentials, and even the authentication key itself.
Know when Avideo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the CDN plugin endpoints plugin/CDN/status.json.php and plugin/CDN/disable.json.php use key-based authentication with an empty string default key. When the CDN plugin is enabled but the key has not been configured (the default state), the key validation check is completely bypassed, allowing any unauthenticated attacker to modify the full CDN configuration - including CDN URLs, storage credentials, and the authentication key itself - via mass-assignment through the par request parameter. Commit adeff0a31ba04a56f411eef256139fd7ed7d4310 contains a patch.
Executive ViewAI
WWBN AVideo installations are vulnerable to unauthorized modification of CDN configuration and storage credentials by unauthenticated attackers, potentially enabling data theft, service disruption, or malware injection. Any organization using AVideo version 26.0 or earlier with the CDN plugin enabled faces immediate risk of credential compromise and loss of control over video delivery infrastructure.
Disable the CDN plugin entirely if not operationally required; implement Web Application Firewall (WAF) rules to block unauthorized CDN plugin API calls; restrict network access to AVideo administration interfaces using IP whitelisting or VPN; segment CDN infrastructure from internal networks; implement immutable audit logging and alerting for CDN configuration changes; rotate storage credentials and authentication keys immediately and monitor for unauthorized access patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in WWBN AVideo Multiple Vulnerabilities
View all 14A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.
An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath
A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit
An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed
Unauthenticated SQL injection in AVideo before 24.0.
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbit
A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.
A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and
A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master co
An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVi
WWBN AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
Exploit-DB