AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints

The primary impact of CVE-2026-34732 is the unauthorized disclosure of sensitive data. Attackers can leverage the missing authentication check to directly query the list.json.php endpoint, bypassing standard access controls. This can expose a wide range of information, including personally identifiable information (PII) of users, detailed payment transaction logs, IP addresses, user agents, and potentially internal system records. The scope of the data exposed is significant, as 21 unauthenticated data listing endpoints are affected across the platform. This vulnerability shares similarities with other data exposure flaws where inadequate access controls lead to unintended data leakage, potentially enabling identity theft, fraud, and further system compromise.

Organizations using wwbn/avideo versions 26.0 and earlier, particularly those with publicly accessible instances or those handling sensitive user data, are at significant risk. Shared hosting environments where multiple users share the same instance are also particularly vulnerable, as an attacker could potentially exploit this vulnerability to access data belonging to other users.

• php: Examine list.json.php for the absence of authentication checks within the CreatePlugin template. Use grep to search for the template code without authentication logic.

grep -r 'CreatePlugin' /path/to/avideo/list.json.php | grep -v 'authentication'

• generic web: Monitor access logs for requests to list.json.php originating from unexpected or unauthorized IP addresses. Look for patterns of repeated requests to the same endpoint.

 grep "/list.json.php" /var/log/apache2/access.log | awk '{print $1}' | sort | uniq -c

• generic web: Check response headers for unusual or unexpected content that might indicate data leakage. Use curl to inspect the headers.

curl -I https://your-avideo-instance/list.json.php

1. 2026-04-01Disclosure

   disclosure

1. Gereserveerd2026-03-30
2. Gepubliceerd2026-04-01
3. EPSS bijgewerkt2026-04-08

The primary mitigation for CVE-2026-34732 is to upgrade to a patched version of wwbn/avideo. Unfortunately, the input does not specify a fixed_in version. Until a patch is available, consider implementing temporary workarounds such as restricting network access to the list.json.php endpoint using a Web Application Firewall (WAF) or proxy server. Configure the WAF to block requests to this endpoint from unauthorized sources. Additionally, review and harden access controls to other related endpoints to minimize the potential attack surface. After upgrade, confirm by verifying that the CreatePlugin template now includes appropriate authentication checks by attempting to access the affected endpoints without proper credentials.

Laatste update

29.0recent