An unauthenticated authentication bypass vulnerability in the WWBN AVideo CDN plugin allows remote attackers to fully compromise CDN configurations, posing a high risk to platform integrity.

The vulnerability exists due to a missing authentication check in the CDN plugin endpoints, where an empty string default key permits unauthenticated access. Attackers can leverage this to modify CDN settings, including storage credentials and authentication keys, by sending malicious requests to the plugin/CDN/status.json.php or plugin/CDN/disable.json.php files.

Successful exploitation allows an attacker to gain unauthorized control over the platform's CDN infrastructure. This can lead to the redirection of video content, theft of storage credentials, or complete hijacking of the administrative authentication mechanism, resulting in significant data loss or service disruption. With a CVSS score of 8.6, this flaw represents a severe risk that requires immediate attention.

Immediate Action: Since no official patched version is currently available, administrators should immediately disable the CDN plugin within the AVideo platform to prevent exploitation.

Proactive Monitoring: Review web server access logs for anomalous requests directed at plugin/CDN/ endpoints, specifically looking for POST requests containing the par parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized traffic targeting the specified CDN plugin endpoints until a permanent security update is released.

Public Exploit Available: No (exploit_available: unknown)

The severity of this vulnerability, combined with the ease of exploitation, necessitates an immediate response. Organizations using WWBN AVideo should prioritize disabling the affected CDN plugin until the vendor provides a secure update. Failure to mitigate this risk leaves the platform exposed to full configuration takeovers by unauthenticated remote actors.