Description Summary:
WWBN AVideo contains a CSRF and path traversal vulnerability in stopLive.php, allowing unauthorized deletion of directories when an administrator interacts with a malicious page.

Executive Summary:
An unauthenticated cross-site request forgery and path traversal vulnerability in WWBN AVideo allows remote attackers to perform unauthorized recursive directory deletion.

Vulnerability Details

CVE-ID: CVE-2026-85160

Affected Software: WWBN AVideo

Affected Versions: 0 through c91b5975d

Vulnerability: The application fails to validate CSRF tokens and performs unsanitized concatenation of the key parameter in stopLive.php, enabling an unauthenticated attacker to manipulate file paths. By enticing an administrator to visit a malicious page, an attacker can trigger the recursive deletion of sensitive directories.

Business Impact

The ability to perform unauthorized directory deletion poses a severe risk to data integrity and service availability. With a CVSS score of 8.1, this high-severity flaw could lead to significant operational disruption, loss of media content, and potential system downtime for the AVideo platform.

Remediation Plan

Immediate Action: Review the official security advisory from WWBN and apply all available security updates or configuration changes provided by the vendor.

Proactive Monitoring: Monitor server access logs for anomalous requests to stopLive.php, specifically identifying patterns involving directory traversal characters like double dots and slashes.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter incoming requests and block those containing suspicious path traversal sequences or unauthorized parameter inputs.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of September 4, 2026, there is no public information indicating active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The design flaw in the parameter handling makes the application inherently susceptible to malicious input manipulation.

Analyst Recommendation

Given the high CVSS score and the potential for total loss of directory data, organizations should treat this vulnerability with high priority. Administrators must restrict access to administrative endpoints and apply the latest vendor patches immediately to prevent unauthorized file system operations.

Description Summary:
WWBN AVideo contains an authentication failure where the video_id_hash credential functions as a permanent, non-revocable bearer token, allowing unauthorized administrative account access.

Executive Summary:
A critical authentication bypass vulnerability exists in WWBN AVideo, allowing unauthenticated attackers to gain full administrative access to user accounts via replayed bearer tokens.

Vulnerability Details

CVE-ID: CVE-2026-85154

Affected Software: WWBN AVideo

Affected Versions: 0 through 29.0

Vulnerability: The application utilizes a video_id_hash that acts as a non-expiring and non-revocable bearer token. An unauthenticated attacker who obtains this token can replay it to impersonate the video owner with full administrative privileges, even if the owner resets their password.

Business Impact

Successful exploitation of this vulnerability results in a complete compromise of user accounts, including administrative sessions. Given the CVSS score of 9.8, this flaw presents an extreme risk, as it allows for unauthorized data access, potential content manipulation, and full account takeover without requiring any valid user credentials.

Remediation Plan

Immediate Action: Upgrade to the latest version of AVideo as soon as the vendor releases a patch that addresses the non-expiring nature of the video_id_hash. Until a patch is available, organizations should restrict access to the affected platform via network-level controls.

Proactive Monitoring: Review web server and application access logs for unusual patterns of authentication requests or repeated use of the same identifier across different sessions. Monitor for suspicious administrative actions originating from unauthorized IP addresses.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to inspect and filter traffic for known malicious patterns associated with AVideo authentication endpoints. Restrict access to the application to trusted networks via VPN or IP allowlisting to reduce the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Sep 3, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the permanent nature of the credential, which bypasses standard security controls like password rotation.

Analyst Recommendation

This vulnerability represents a severe threat to the integrity and confidentiality of AVideo installations. Security teams must prioritize patching as soon as the vendor provides a resolution, as the lack of credential expiration makes this an ideal target for persistent unauthorized access. Ensure that monitoring is active to detect any attempts to leverage stolen tokens until the environment is fully secured.

Description Summary:
WWBN AVideo contains a cross-site request forgery vulnerability in origin validation functions, allowing unauthenticated attackers to perform administrative configuration changes.

Executive Summary:
A critical cross-site request forgery vulnerability in WWBN AVideo allows unauthenticated attackers to perform unauthorized administrative configuration changes on affected systems.

Vulnerability Details

CVE-ID: CVE-2026-84482

Affected Software: WWBN AVideo

Affected Versions: 0 through 9c39d8c8b4c1f75540788d6b391740852ceb0732

Vulnerability: The application fails to properly validate referer origins within the get_domain and isSameDomain functions. This allows an unauthenticated attacker to forge requests from malicious or malformed origins to execute administrative ObjectYPT writes.

Business Impact

The ability for an unauthenticated attacker to modify live server configurations presents a significant risk to system integrity and availability. Given the CVSS score of 8.8, this vulnerability is considered high severity, as it could lead to total service disruption, unauthorized data modification, or the hijacking of administrative functions.

Remediation Plan

Immediate Action: Review the official security advisory at the WWBN AVideo GitHub repository to identify the necessary commit or patch to resolve this origin validation error.

Proactive Monitoring: Monitor server access logs for suspicious administrative requests originating from unexpected referer headers or unusual subdomains.

Compensating Controls: Deploy a Web Application Firewall (WAF) to enforce strict referer header validation and block requests that do not originate from trusted, authorized domains.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of September 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw is not currently weaponized, the lack of proper origin validation in administrative functions makes this a high-value target for attackers seeking to gain control over AVideo instances.

Analyst Recommendation

Due to the high severity of this vulnerability and the potential for complete administrative compromise, organizations using WWBN AVideo must prioritize securing their environments. Administrators should immediately audit their current commit level and apply any available vendor patches or mitigations to prevent unauthorized configuration changes.

Description Summary:
WWBN AVideo fails to validate password recovery token expiration, allowing unauthenticated attackers to reuse expired tokens to reset user passwords and gain full account access.

Executive Summary:
A critical vulnerability in WWBN AVideo allows unauthenticated attackers to perform account takeovers by exploiting improper password recovery token validation.

Vulnerability Details

CVE-ID: CVE-2026-84480

Affected Software: WWBN AVideo

Affected Versions: 0 through 29.0

Vulnerability: This vulnerability is caused by insufficient session expiration (CWE-613) within the userRecoverPassSave.json.php file. An unauthenticated attacker can leverage expired recovery tokens to indefinitely reset passwords for any account.

Business Impact

The ability for an unauthenticated attacker to reset passwords for arbitrary user accounts poses a severe risk to organizational data and system integrity. Given the 9.8 CVSS score, this flaw is categorized as critical, as it facilitates full account takeover, potentially leading to unauthorized access to sensitive video content, user data, and administrative functions.

Remediation Plan

Immediate Action: Update WWBN AVideo to the latest version, which includes the necessary validation logic to enforce password recovery token expiration.

Proactive Monitoring: Review web access logs for unusual patterns of requests to userRecoverPassSave.json.php, specifically looking for repeated attempts or anomalous timing related to password reset flows.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to limit the rate of requests to password recovery endpoints, which may impede automated exploitation attempts until patching is complete.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Sep 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly exploitable due to the lack of required authentication and the simplicity of the attack vector.

Analyst Recommendation

This vulnerability represents a significant security risk due to the potential for widespread account compromise. Administrators must prioritize updating AVideo to the latest version immediately to ensure that password recovery tokens are properly invalidated after use or expiration. Failure to remediate this flaw could result in complete loss of control over the affected AVideo platform.

Description Summary:
WWBN AVideo improperly relies on the User-Agent header for authentication security, allowing attackers to bypass two-factor authentication and security auditing mechanisms.

Executive Summary:
A critical authentication bypass vulnerability in WWBN AVideo allows unauthenticated attackers to circumvent two-factor authentication and audit logging by spoofing the User-Agent header.

Vulnerability Details

CVE-ID: CVE-2026-84479

Affected Software: WWBN AVideo

Affected Versions: 0 through 29.0

Vulnerability: This vulnerability, categorized as CWE-290, occurs because the application uses easily spoofed client-supplied User-Agent headers to validate login-time security controls. An attacker can bypass two-factor authentication and brute-force protections by setting the header to specific literals.

Business Impact

The ability to bypass two-factor authentication presents a severe risk of unauthorized account access, potentially leading to full compromise of administrative or user accounts. With a CVSS score of 9.1, this flaw poses a critical threat to data confidentiality and integrity, as attackers can operate without triggering standard security audit trails or brute-force mitigation.

Remediation Plan

Immediate Action: As no patch is currently available, administrators should restrict access to the application via network-level controls or a VPN to mitigate exposure.

Proactive Monitoring: Review web server access logs for anomalous User-Agent strings or successful logins that lack corresponding two-factor authentication events.

Compensating Controls: Implement a Web Application Firewall (WAF) to block or sanitize requests containing suspicious User-Agent headers, or disable the vulnerable encoder/mobile app features if they are not required for business operations.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Sep 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The reliance on client-side headers for security logic makes this implementation inherently fragile and trivial to exploit.

Analyst Recommendation

Given the critical severity of this authentication bypass, organizations must treat this vulnerability with extreme urgency. Since a vendor patch is not yet available, organizations should prioritize implementing the suggested compensating controls and monitoring measures to prevent unauthorized access. Monitor the vendor advisory page for updates and apply the official patch immediately upon release.

Description Summary:
WWBN AVideo contains an SSRF filter bypass vulnerability in the isSSRFSafeURL function that fails to normalize NAT64 hex-encoded addresses, allowing access to internal services.

Executive Summary:
An SSRF filter bypass vulnerability in WWBN AVideo allows authenticated attackers with low privileges to access sensitive cloud metadata and internal network services.

Vulnerability Details

CVE-ID: CVE-2026-82648

Affected Software: WWBN AVideo

Affected Versions: All versions of WWBN AVideo are affected.

Vulnerability: The vulnerability resides in the isSSRFSafeURL function, which fails to correctly normalize NAT64 addresses written in hexadecimal format. An authenticated user with low privileges can leverage this flaw to bypass SSRF protections and reach cloud metadata services or internal loopback interfaces.

Business Impact

Successful exploitation of this vulnerability poses a significant risk to internal infrastructure security. By bypassing SSRF filters, an attacker can access sensitive cloud instance metadata or interact with internal services that are not intended to be publicly reachable. Given the 7.1 CVSS score, this represents a high-severity risk that could lead to unauthorized information disclosure and lateral movement within the network.

Remediation Plan

Immediate Action: Apply the vendor security updates provided in the official advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-88jm-rxg9-3v5r.

Proactive Monitoring: Review application access logs for suspicious requests containing hexadecimal-encoded NAT64 addresses or attempts to access internal IP ranges and cloud metadata endpoints (e.g., 169.254.169.254).

Compensating Controls: Implement strict egress filtering on the application server to prevent connections to internal-only subnets and metadata services.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of August 31, 2026, there is no public information indicating active exploitation in the wild. However, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous as it subverts security controls designed to isolate the application from the internal network.

Analyst Recommendation

The severity of this vulnerability, combined with the presence of a known proof-of-concept, necessitates immediate action. Administrators must prioritize updating their AVideo instances to the latest available version to mitigate the risk of unauthorized internal service access.

Description Summary:
AVideo is vulnerable to an unauthenticated credential disclosure flaw due to improper cryptographic validation, allowing attackers to forge tokens and access sensitive stream keys for external platforms.

Executive Summary:
WWBN AVideo contains an unauthenticated information disclosure vulnerability that allows attackers to retrieve sensitive stream credentials, posing a significant risk to user account integrity.

Vulnerability Details

CVE-ID: CVE-2026-82645

Affected Software: WWBN AVideo

Affected Versions: Current commit e01e41ecc and earlier

Vulnerability: The application fails to properly validate cryptographic tokens used in the getLiveKey.json.php endpoint, allowing an unauthenticated attacker to forge valid tokens and bypass access controls to retrieve stream_key and stream_url data.

Business Impact

Successful exploitation allows unauthorized third parties to hijack or monitor live streams hosted on external platforms like YouTube, Facebook, and Twitch. This results in direct loss of intellectual property, potential brand damage, and a complete compromise of the affected user's streaming account security. Given the high CVSS score of 8.6, this vulnerability represents a critical threat to the confidentiality of user data.

Remediation Plan

Immediate Action: Review the official security advisory at the provided GitHub repository and apply the latest available patches or updates to the AVideo instance.

Proactive Monitoring: Monitor server access logs for anomalous requests directed at the getLiveKey.json.php endpoint, particularly those containing forged tokens or unusual parameter structures.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized or suspicious access to the /plugin/Live/view/Live_restreams/ directory until a patch is applied.

Exploitation Status

Public Exploit Available: No (the vulnerability is documented via research write-ups, but no weaponized exploit or public PoC is confirmed in the provided data).

Analyst Notes: As of August 31, 2026, there is no public information indicating active exploitation or a functional public proof-of-concept for this vulnerability. The flaw is inherently exploitable because the underlying encryption mechanism lacks integrity checks and uses a deterministic initialization vector.

Analyst Recommendation

The severity of this credential disclosure flaw necessitates immediate attention. Administrators must prioritize the application of vendor-supplied patches to close the cryptographic vulnerability. If patching is delayed, restricting network access to the affected endpoint is essential to prevent unauthorized credential harvesting by remote, unauthenticated attackers.

Description Summary:
WWBN AVideo contains a brute-force rate limiting bypass in the enforceRateLimit function, allowing unauthenticated attackers to perform unrestricted password-guessing attacks.

Executive Summary:
WWBN AVideo is vulnerable to a critical rate limiting bypass that allows unauthenticated attackers to conduct unlimited brute-force login attempts against the platform.

Vulnerability Details

CVE-ID: CVE-2026-82644

Affected Software: WWBN AVideo

Affected Versions: e01e41ecc and earlier

Vulnerability: The application utilizes a flawed rate limiting mechanism in the enforceRateLimit function that fails to increment attempt counters for clients identified as bots. Because the isBot function incorrectly classifies requests with missing or specific User-Agent headers as bots, unauthenticated attackers can bypass authentication protections entirely.

Business Impact

The ability to perform unrestricted brute-force attacks significantly increases the risk of unauthorized account access and potential compromise of sensitive user data. With a CVSS score of 7.5, this vulnerability represents a high-risk security flaw that could lead to full account takeover, resulting in operational disruption and potential regulatory non-compliance regarding user authentication security.

Remediation Plan

Immediate Action: Monitor the official WWBN AVideo GitHub repository for the release of a security patch and apply it immediately upon availability.

Proactive Monitoring: Review web access logs for unusual spikes in login attempts or requests originating from clients with suspicious or missing User-Agent headers.

Compensating Controls: Implement a Web Application Firewall (WAF) to block or rate-limit suspicious traffic patterns and enforce strict User-Agent requirements at the perimeter level.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 31, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ease of exploitation, as it requires only the omission or modification of the User-Agent header to circumvent security controls.

Analyst Recommendation

Given the high severity of this authentication bypass, administrators must prioritize the protection of login endpoints. While waiting for an official vendor patch, it is recommended to restrict access to login interfaces by IP address or employ additional authentication layers to mitigate the risk of brute-force attempts until the underlying code flaw is resolved.

Description Summary:
AVideo contains an OS command injection vulnerability in the Live plugin, where insufficient escaping allows attackers to execute arbitrary system commands via the on_publish.php endpoint.

Executive Summary:
A critical OS command injection vulnerability in the AVideo Live plugin allows unauthenticated attackers to execute arbitrary system commands on the host server.

Vulnerability Details

CVE-ID: CVE-2026-64625

Affected Software: WWBN AVideo

Affected Versions: 0 up to (excluding) 29.0

Vulnerability: This is a command injection vulnerability where the execAsync function improperly handles user input. Even with basic sanitization, an attacker can use command substitution techniques to bypass security filters and execute unauthorized operating system commands as the web server user.

Business Impact

Successful exploitation allows an attacker to execute arbitrary commands on the host operating system. This typically results in a complete system compromise, enabling the attacker to install backdoors, pivot into the internal network, or destroy data. The CVSS score of 9.8 highlights the critical nature of this vulnerability.

Remediation Plan

Immediate Action: Update to AVideo version 29.0 or later to ensure the command execution functions are correctly secured against injection attacks.

Proactive Monitoring: Monitor server logs for shell-related commands or unusual process spawning, especially those related to the AVideo Live plugin and on_publish.php.

Compensating Controls: Implement strict file system permissions to limit the web server user's ability to execute system binaries and utilize a WAF to filter out common command injection patterns in incoming requests.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly concerning as it involves a bypass of previously implemented security controls, indicating a complex and potentially fragile remediation history.

Analyst Recommendation

Command injection vulnerabilities are among the most dangerous flaws for web applications. All instances of AVideo must be updated to version 29.0 immediately to address this critical security gap. If immediate patching is not possible, ensure the AVideo instance is isolated or access-restricted to minimize the attack surface.

Description Summary:
AVideo versions 29.0 and earlier contain an OS command injection vulnerability in the ffmpeg-json.php file, enabling unauthenticated attackers to execute arbitrary commands.

Executive Summary:
An OS command injection vulnerability in WWBN AVideo allows unauthenticated remote attackers to execute arbitrary commands, creating a high risk of total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-63305

Affected Software: WWBN AVideo

Affected Versions: 0 through 29.0

Vulnerability: This is an OS command injection vulnerability (CWE-78) located in the ffmpeg-json.php file. It permits an unauthenticated attacker to manipulate input parameters to execute arbitrary system commands.

Business Impact

The impact of this vulnerability is significant, as it allows for full system control if the application server is compromised. This could result in unauthorized data exfiltration, service disruption, or the installation of persistent malicious backdoors. The CVSS score of 8.1 underscores the high risk posed to the confidentiality and integrity of the affected environment.

Remediation Plan

Immediate Action: Check the vendor GitHub repository for security patches and apply them as soon as they become available.

Proactive Monitoring: Inspect application logs for unusual request patterns targeting ffmpeg-json.php, particularly those containing shell characters or unexpected input lengths.

Compensating Controls: Utilize a Web Application Firewall to filter and block malicious traffic directed at the vulnerable PHP endpoint.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication requirements makes this an attractive target for automated exploitation tools.

Analyst Recommendation

Organizations utilizing AVideo should treat this vulnerability as high priority. Administrators must monitor vendor channels for the release of a patch and ensure that adequate perimeter defenses are in place to mitigate potential exploitation attempts.

Description Summary:
AVideo versions 29.0 and earlier are susceptible to an OS command injection vulnerability in the listffmpegprocesses function, which allows unauthenticated attackers to execute arbitrary commands.

Executive Summary:
A critical OS command injection vulnerability in WWBN AVideo allows unauthenticated attackers to execute arbitrary system commands, posing a severe risk to server integrity.

Vulnerability Details

CVE-ID: CVE-2026-63304

Affected Software: WWBN AVideo

Affected Versions: 0 through 29.0

Vulnerability: This vulnerability is an OS command injection flaw (CWE-78) occurring within the listffmpegprocesses function. It allows an unauthenticated attacker to inject malicious commands into the underlying operating system.

Business Impact

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary code with the privileges of the web server. This could lead to a full compromise of the application server, unauthorized access to sensitive video content, or lateral movement within the network. With a CVSS score of 8.1, the high severity reflects the potential for total loss of confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Review the official WWBN AVideo security advisory on GitHub to determine if a patched version has been released, and apply updates immediately.

Proactive Monitoring: Monitor server logs for suspicious process execution patterns or unexpected shell commands originating from the web server user account.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common OS command injection payloads, such as those involving shell metacharacters.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous because it does not require prior authentication to trigger.

Analyst Recommendation

Given the high CVSS score and the existence of a proof-of-concept, this vulnerability warrants immediate attention. Security teams should prioritize patching or implementing protective WAF rules to prevent unauthorized command execution on the host system.

Description Summary:
AVideo contains an authentication bypass vulnerability where improper validation of video hash credentials allows for passwordless login as the video owner.

Executive Summary:
An authentication bypass vulnerability in WWBN AVideo allows unauthorized users to gain account access, posing a severe risk to platform integrity.

Vulnerability Details

CVE-ID: CVE-2026-59808

Affected Software: WWBN AVideo

Affected Versions: 0 through 9c39d8c8b4c1f75540788d6b391740852ceb0732

Vulnerability: This flaw exists in the authentication logic where deduplicateByEncoderQueueId and useVideoHashOrLogin functions fail to verify ownership before issuing credentials. An attacker with low privileges can leverage this to bypass authentication mechanisms and impersonate other users.

Business Impact

The ability to bypass authentication and impersonate users presents a critical threat to data confidentiality and system integrity. An attacker could gain full control over victim accounts, leading to unauthorized access to sensitive media, administrative functions, or user data. With a CVSS score of 8.8, this high severity vulnerability warrants immediate attention to prevent account takeover incidents.

Remediation Plan

Immediate Action: Update the AVideo installation to a version beyond commit 9c39d8c8b4c1f75540788d6b391740852ceb0732 as provided by the vendor.

Proactive Monitoring: Review application access logs for unusual patterns of authentication, specifically looking for accounts accessing resources without standard login flows.

Compensating Controls: Deploy a Web Application Firewall to monitor and block suspicious requests targeting video processing or authentication endpoints.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit)

Analyst Notes: As of August 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it allows for direct account hijacking via a logic error in credential handling.

Analyst Recommendation

The severity of this authentication bypass requires immediate action to secure the AVideo environment. Administrators should verify their current commit hash and apply the necessary updates to ensure that ownership verification is properly enforced for all sessions.

Description Summary:
The WWBN AVideo platform contains an authorization bypass vulnerability where the getToken function generates insecure tokens, leading to unauthorized access.

Executive Summary:
An authorization bypass vulnerability in WWBN AVideo allows unauthenticated attackers to gain unauthorized access to sensitive information by exploiting insecure token generation.

Vulnerability Details

CVE-ID: CVE-2026-59256

Affected Software: WWBN AVideo

Affected Versions: 0 through 9c39d8c8b4c1f75540788d6b391740852ceb0732

Vulnerability: The vulnerability stems from the improper implementation of the getToken function, which fails to bind tokens to specific user identities or purposes (CWE-200). This allows an unauthenticated actor to bypass authorization controls and access sensitive areas of the application.

Business Impact

This flaw exposes the application to significant data confidentiality risks, as unauthorized users can access protected gallery sections and potentially other sensitive data. The high CVSS score of 7.5 reflects the ease of exploitation and the potential for broad unauthorized access to the platform contents.

Remediation Plan

Immediate Action: Review the official security advisory and apply the recommended security configuration or patch if available.

Proactive Monitoring: Review application logs for suspicious access patterns to the gallery and section views, particularly from unauthenticated sessions.

Compensating Controls: Restrict access to the affected application components at the network or WAF level until a permanent patch is confirmed and applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of proper binding in the token logic makes this an attractive target for attackers seeking unauthorized access.

Analyst Recommendation

The exposure of sensitive information via an authorization bypass is a critical security failure. Administrators must monitor vendor communications for the release of a definitive fix and apply it immediately to prevent potential data breaches.

Description Summary:
WWBN AVideo contains a cross-site request forgery vulnerability in the releaseVideoNow function that allows unauthorized actions.

Executive Summary:
A cross-site request forgery vulnerability in WWBN AVideo allows unauthenticated attackers to perform unauthorized actions, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2026-58003

Affected Software: WWBN AVideo

Affected Versions: 0 through 9c39d8c8b4c1f75540788d6b391740852ceb0732

Vulnerability: The application is susceptible to a Cross-Site Request Forgery (CSRF) attack via the releaseVideoNow function. This vulnerability allows an unauthenticated attacker to trick a user into performing state-changing actions without their consent.

Business Impact

This vulnerability carries a CVSS score of 7.1, reflecting a high severity due to the potential for unauthorized data modification. Successful exploitation could lead to unauthorized video releases or configuration changes, resulting in reputational damage and loss of control over content distribution platforms.

Remediation Plan

Immediate Action: Review the official GitHub advisory provided by WWBN to identify the specific commit or release that contains the fix for this CSRF flaw.

Proactive Monitoring: Monitor server access logs for unusual patterns of POST requests targeting the releaseVideoNow endpoint that do not originate from legitimate user sessions.

Compensating Controls: Implement anti-CSRF tokens for all state-changing operations and ensure that the application enforces strict SameSite cookie attributes to mitigate unauthorized cross-origin requests.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. CSRF vulnerabilities are inherently dependent on user interaction, making them effective targets for social engineering campaigns.

Analyst Recommendation

Given the high severity of this vulnerability, administrators should prioritize evaluating the security advisory provided by the vendor. Ensure that the application is updated to a version beyond the identified vulnerable commit to neutralize the risk of unauthorized state changes.

Description Summary:
WWBN AVideo is affected by an OS command injection vulnerability, potentially allowing unauthenticated attackers to execute arbitrary commands on the underlying system.

Executive Summary:
An OS command injection vulnerability in WWBN AVideo version 29.0 and earlier poses a severe risk of unauthorized system compromise.

Vulnerability Details

CVE-ID: CVE-2026-55173

Affected Software: WWBN AVideo

Affected Versions: <= 29.0

Vulnerability: This is an OS command injection vulnerability (CWE-78) where the application fails to properly neutralize special elements in user-supplied input. The vulnerability is exploitable by an unauthenticated attacker over the network.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary operating system commands with the privileges of the web server. This could lead to a full system compromise, data exfiltration, or the deployment of persistent malware. Given the CVSS score of 8.1, this represents a high-severity risk to the integrity and availability of the platform.

Remediation Plan

Immediate Action: Upgrade to the latest version of WWBN AVideo as specified in the vendor security advisory.

Proactive Monitoring: Monitor system logs for unusual process execution patterns or unexpected shell commands initiated by the web server process.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common command injection patterns in HTTP requests.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Command injection flaws are inherently dangerous and often targeted by automated scanners, making rapid patching essential.

Analyst Recommendation

The severity of this vulnerability necessitates an immediate response. Administrators should prioritize updating their AVideo instances to the latest secure version to neutralize the risk of remote code execution.

Description Summary:
A stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin of AVideo allows unauthenticated attackers to hijack administrative sessions via malicious WebSocket parameters.

Executive Summary:
An unauthenticated remote attacker can achieve full administrative takeover of the WWBN AVideo platform by exploiting a stored DOM Cross-Site Scripting vulnerability to hijack active sessions.

Vulnerability Details

CVE-ID: CVE-2026-54458

Affected Software: WWBN AVideo

Affected Versions: <= 29.0

Vulnerability: The vulnerability stems from improper neutralization of input within the YPTSocket plugin, which processes attacker-controlled WebSocket parameters without validation. This allows an unauthenticated attacker to inject malicious JavaScript that executes within the context of an administrator session.

Business Impact

The CVSS score of 9.6 highlights the critical risk of this vulnerability. Successful exploitation grants an attacker full control over the video platform, enabling data exfiltration, unauthorized modification of content, and potential lateral movement within the network. This represents a complete compromise of the platform's integrity and confidentiality.

Remediation Plan

Immediate Action: Update the WWBN AVideo platform to the latest version, which includes the fix provided in the referenced commit.

Proactive Monitoring: Review web server and application logs for suspicious WebSocket connection requests or anomalies in the YPTSocket plugin traffic.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect and block malicious input in WebSocket parameters that may attempt to inject unauthorized scripts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. However, the flaw is inherently dangerous because it chains a simple anonymous connection into a full administrative takeover.

Analyst Recommendation

Given the potential for complete administrative compromise, organizations using AVideo must treat this as a high-priority update. Upgrading to the latest version is the only effective way to neutralize this cross-site scripting risk and prevent unauthorized access to sensitive administrative dashboards.

Description Summary:
A WebSocket-based cross-site scripting (XSS) vulnerability in the AVideo YPTSocket plugin allows unauthenticated attackers to achieve universal account takeover.

Executive Summary:
An unauthenticated XSS vulnerability in the WWBN AVideo YPTSocket plugin allows attackers to remotely execute JavaScript in the context of other users, leading to full account takeover.

Vulnerability Details

CVE-ID: CVE-2026-40911

Affected Software: WWBN AVideo

Affected Versions: 29.0 and prior

Vulnerability: The YPTSocket server relays unsanitized JSON messages to connected clients, which then execute the malicious payload via eval() sinks in the client-side script.

Business Impact

With a CVSS score of 10.0, this is a critical vulnerability. An attacker can hijack administrative sessions, steal sensitive user data, and execute privileged actions across the platform, resulting in total loss of platform integrity and trust.

Remediation Plan

Immediate Action: Apply the fix provided in commit c08694bf6264eb4decceb78c711baee2609b4efd or update to the latest patched version.

Proactive Monitoring: Monitor WebSocket traffic for anomalous JSON messages containing suspicious msg or callback fields.

Compensating Controls: If patching is delayed, consider disabling the YPTSocket plugin entirely to mitigate the risk of remote code execution within user browsers.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is exceptionally dangerous due to its unauthenticated nature and the ability to target multiple users simultaneously. Administrators must prioritize the application of the vendor-supplied fix to prevent widespread account compromise.

Description Summary:
WWBN AVideo contains a critical SQL injection vulnerability in its stream key lookup path, allowing unauthenticated attackers to execute malicious database queries.

Executive Summary:
Unauthenticated attackers can compromise the WWBN AVideo database via SQL injection in the stream key lookup process, potentially leading to full system takeover.

Vulnerability Details

CVE-ID: CVE-2026-34374

Affected Software: WWBN AVideo

Affected Versions: Versions up to and including 26.0

Vulnerability: A SQL injection exists in the Live_schedule::keyExists() method. While the primary lookup is parameterized, a fallback mechanism interpolates the stream key directly into a SQL string. This path is accessible to unauthenticated attackers during RTMP publish authentication.

Business Impact

A successful SQL injection can lead to the exposure of sensitive user data, administrative credentials, and video content. Depending on database permissions, an attacker might also achieve remote code execution on the underlying server. The CVSS score of 9.1 underscores the critical risk to data confidentiality and system integrity.

Remediation Plan

Immediate Action: Since no patched version is available as of publication, administrators should consider disabling RTMP publishing or implementing strict input validation at the reverse proxy level.

Proactive Monitoring: Monitor database logs for unusual query syntax or errors originating from the Live_schedule class.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules specifically targeting the RTMP authentication endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 27, 2026, there is no public information indicating active exploitation. However, the lack of a vendor patch at the time of disclosure significantly increases the window of risk.

Analyst Recommendation

Organizations using WWBN AVideo must be on high alert due to the lack of an official patch. It is recommended to monitor the vendor's repository for security updates and apply them the moment they become available. In the interim, implement aggressive WAF filtering to block potential SQL injection payloads in stream key parameters.

Description Summary:
A cross-site scripting (XSS) vulnerability in the LoginWordPress loginForm cancelUri parameter of WWBN AVideo allows arbitrary JavaScript execution via crafted HTTP requests.

Executive Summary:
The WWBN AVideo application is susceptible to a reflected cross-site scripting vulnerability that could allow an attacker to execute arbitrary JavaScript in the context of a user session.

Vulnerability Details

CVE-ID: CVE-2025-36548

Affected Software: WWBN AVideo

Affected Versions: 14.4, dev master commit 8a8954ff

Vulnerability: This is a stored or reflected cross-site scripting (CWE-79) vulnerability located in the cancelUri parameter of the loginForm functionality. The vulnerability is unauthenticated, as it can be triggered by enticing a user to visit a malicious webpage containing a crafted request.

Business Impact

Successful exploitation allows an attacker to execute arbitrary scripts in the victim's browser, potentially leading to session hijacking, unauthorized actions performed on behalf of the user, or the theft of sensitive session cookies. With a CVSS score of 8.3, this flaw is categorized as High severity due to the potential for total impact on confidentiality, integrity, and availability within the affected user's session.

Remediation Plan

Immediate Action: There is no specific patch version provided at this time; users should monitor the WWBN security advisory page and the Talos Intelligence report for the release of a security update.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous requests containing suspicious JavaScript payloads within the cancelUri parameter.

Compensating Controls: Implement a robust Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests that contain malicious script tags or encoded characters within the loginForm parameters.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 25, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw requires user interaction to execute, but the high impact rating necessitates proactive defensive measures.

Analyst Recommendation

Given the High severity of this vulnerability, administrators should treat this as a significant risk to user security. While waiting for an official patch from WWBN, organizations should restrict access to the affected login interface if possible and ensure that all users are aware of the risks associated with clicking untrusted links or navigating to suspicious web pages.