A critical security vulnerability in WWBN AVideo allows for total administrative takeover due to the use of insecure default credentials in default Docker configurations.

This vulnerability involves the insecure default initialization of resources, where the application defaults to using "password" for the admin account and insecure credentials for database access. This flaw is unauthenticated, as the system does not enforce credential changes upon initial deployment.

The presence of hardcoded default credentials creates a significant risk of unauthorized administrative access, which can lead to complete system compromise. Attackers gaining administrative privileges can manipulate video content, exfiltrate sensitive user data, or execute arbitrary code through plugin management, resulting in severe reputational damage and data loss. Given the CVSS score of 8.1, this vulnerability represents a high-risk exposure for any organization utilizing default AVideo deployment patterns.

Immediate Action: Upgrade to version 26.0 or higher immediately to resolve the insecure configuration. For existing deployments, manually update all administrative and database passwords to strong, unique strings immediately.

Proactive Monitoring: Review access logs for unauthorized administrative logins or anomalous plugin installation activity. Monitor database connection logs for any successful authentication attempts using the default credentials.

Compensating Controls: Ensure that AVideo instances are not exposed to the public internet without an application-level firewall or VPN restriction. Restrict network access to the management interface to trusted administrative subnets only.

Public Exploit Available: Unknown.

Organizations currently running WWBN AVideo must prioritize this update as a matter of urgency. Because the default credentials are well-documented and easily guessable, any instance left in its default configuration is essentially open to the public. Administrators should verify their current version and perform a comprehensive security audit of all credential settings to ensure no other default values remain in use.