CVE-2026-35450
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
In WWBN AVideo versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. Other FFmpeg management endpoints require admin privileges.
Risk Assessment
Unauthenticated attackers can obtain connectivity status of the FFmpeg server, aiding in infrastructure reconnaissance and potential attacks.
Recommendation
Upgrade WWBN AVideo to a version later than 26.0 or secure the check.ffmpeg.json.php endpoint with authentication.
Original NVD description (English source)
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints (kill.ffmpeg.json.php, list.ffmpeg.json.php, ffmpeg.php) require User::isAdmin().