A critical authentication bypass in WWBN AVideo versions 25.0 and below allows unauthenticated remote attackers to perform a full system takeover.

This is a missing authentication for critical function (CWE-306) vulnerability located in the install/checkConfiguration.php endpoint. The flaw allows an unauthenticated attacker to trigger the application initialization process, enabling the creation of an administrative account and unauthorized database configuration.

Successful exploitation of this vulnerability results in full administrative compromise of the AVideo platform. This allows attackers to manipulate video content, access sensitive configuration data, and potentially execute arbitrary code or pivot into the underlying server environment. Given the CVSS score of 8.1, the risk of total loss of confidentiality, integrity, and availability is high, warranting immediate remediation.

Immediate Action: Upgrade WWBN AVideo to version 26.0 or later to ensure the installation endpoint is properly secured against unauthenticated access.

Proactive Monitoring: Monitor server access logs for anomalous POST requests directed at the /install/checkConfiguration.php path, especially from unauthorized IP addresses.

Compensating Controls: If an immediate upgrade is not feasible, restrict network access to the installation directory at the web server level to ensure that only authorized administrators can reach the configuration endpoints.

Public Exploit Available: Unknown.

The severity of this vulnerability is significant due to the potential for total administrative takeover of the affected platform. Organizations currently running AVideo version 25.0 or earlier must prioritize upgrading to version 26.0 immediately. If an upgrade is not immediately possible, strict access control restrictions must be placed on the installation directory to prevent unauthorized configuration by remote actors.