WWBN AVideo EUVD-2026-69723

No special conditions for triggering the disclosure itself - the MobileManager plugin endpoint is accessible to unauthenticated remote clients over HTTP/HTTPS on any network-reachable AVideo instance running through version 30.0 with the MobileManager plugin installed. The sole limiting factor is whether the MobileManager plugin is present and enabled; installations that have not installed this plugin are not affected. No authentication, no session token, and no specific browser or client state is required. The disclosed data (TLS file paths, socket config, debug flags) amplifies risk only when combined with a secondary vulnerability capable of reading arbitrary files.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N correctly captures the moderate confidentiality impact - this is a low-barrier reconnaissance primitive, not direct code execution or credential theft. The leaked TLS key file paths do not expose the key material itself, but combined with a path traversal or file-read vulnerability elsewhere in the application, an attacker could pivot to private key exfiltration, enabling TLS interception. Debug flag disclosure can reveal logging verbosity and error detail levels useful for further exploitation. No EPSS score or KEV status is available in the provided data, and no public POC is mentioned. Real-world priority is moderate: the endpoint is trivially exploitable but the immediate direct impact is limited to enabling follow-on attacks rather than autonomous compromise. Organizations running AVideo with HTTPS termination at the application layer face higher residual risk due to TLS path leakage.

An attacker targeting a self-hosted AVideo instance sends a single unauthenticated HTTP GET request to https://target.example.com/plugin/MobileManager/getConfiguration.json.php and receives a JSON response containing the server's TLS private key filesystem path (e.g., /etc/ssl/private/avideo.key) and socket port details. The attacker then uses this path in a subsequent directory traversal or file-read vulnerability to retrieve the actual key material, enabling TLS session decryption or impersonation. No public exploit code is identified at time of analysis, but the attack requires only a single HTTP request.