CVE-2026-35179
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
WWBN AVideo up to version 26.0 has a vulnerability in the SocialMediaPublisher plugin where the publishInstagram.json.php endpoint acts as an unauthenticated proxy to the Facebook/Instagram Graph API. This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform's own credentials.
Risk Assessment
An attacker can use the server as a proxy to perform unauthorized Graph API operations, potentially leading to data theft, privacy breaches, or API quota abuse.
Recommendation
Immediately update to the latest version of AVideo that fixes this vulnerability, and restrict access to the endpoint to authenticated users only.
Original NVD description (English source)
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the SocialMediaPublisher plugin exposes a publishInstagram.json.php endpoint that acts as an unauthenticated proxy to the Facebook/Instagram Graph API. The endpoint accepts user-controlled parameters including an access token, container ID, and Instagram account ID, and passes them directly to the Graph API via InstagramUploader::publishMediaIfIsReady(). This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform's own credentials.