CVE-2026-43873
HighSummary
AVideo is an open-source video platform that, in versions up to 29.0, exposes the local CloneSite shared secret in the HTTP response to every unauthenticated request. This secret can be exploited by an attacker to impersonate the victim and gain access to the remote database.
Risk Assessment
The exposure of the authentication key poses a serious security risk, allowing attackers to access the victim's remote database data.
Recommendation
It is recommended to upgrade to AVideo versions above 29.0 to eliminate this vulnerability and secure access to CloneSite against unauthorized requests.
Other vulnerabilities in AVideo
See all- CVE-2026-43884High
AVideo is an open source video platform that is vulnerable to SSRF attacks in versions up to 29.0. Two endpoints improperly validate user-supplied URLs, allowing an attacker to redirect to internal resources.
- CVE-2026-43874High
AVideo is an open-source video platform that has a vulnerability in versions up to 29.0 allowing an unauthenticated attacker to send malicious messages via WebSocket. This vulnerability arises from improper JSON data handling, enabling PHP code execution on the server.
- CVE-2026-72748Critical
AVideo has an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint, allowing remote attackers to write up to 4 GB of arbitrary content via HTTP PUT without authentication.
- CVE-2026-64625Critical
AVideo before 29.0 contains an incomplete fix for CVE-2026-45578. execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $() and backticks. Attackers can inject arbitrary OS commands through the Live plugin on_publish.php endpoint despite escapeshellarg() protection.
- CVE-2026-54458Critical
WWBN AVideo before version 29.0 contains a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. An unauthenticated remote attacker can execute arbitrary JavaScript in the context of an administrator viewing the online users debug panel.
- CVE-2025-34433Critical
AVideo versions 14.3.1 prior to 20.1 contain an unauthenticated remote code execution vulnerability caused by predictable generation of an installation salt using PHP uniqid(). The installation timestamp is exposed via a public endpoint, and a derived hash identifier is accessible through unauthenticated API responses, allowing attackers to brute-force the remaining entropy. The recovered salt can then be used to encrypt a malicious payload supplied to a notification API endpoint that evaluates attacker-controlled input, resulting in arbitrary code execution as the web server user.
- CVE-2025-34434Critical
AVideo versions prior to 20.1 with the ImageGallery plugin enabled is vulnerable to unauthenticated file upload and deletion. Plugin endpoints responsible for managing gallery images fail to enforce authentication checks and do not validate ownership, allowing unauthenticated attackers to upload or delete images associated with any image-based video.
- CVE-2026-81733Medium
WWBN AVideo through 30.0 (and master up to commit 4cb576e) contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $_REQUEST via a GET request without enforcing a CSRF token or origin check. An attacker who lures a logged-in streamer to a malicious page can silently change the live-channel viewer-redirect settings, causing viewers to be redirected to a phishing site or shown a spoofed message.
- CVE-2026-81732Medium
WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to user registration statistics. Attackers can send GET requests to these endpoints to retrieve daily and cumulative user-registration counts without any session or authorization.
- CVE-2026-81678High
AVideo before version 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can bypass SSRF protections via the LiveLinks proxy endpoint to reach internal services and cloud metadata endpoints.
Original NVD description (English source)
WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/CloneSite/cloneClient.json.php echoes the local CloneSite shared secret ($objClone->myKey, a constant md5($global['systemRootPath'] . $global['salt'])) into the HTTP response body on every unauthenticated request. The unauthenticated error branch was intended to reject non-admin callers without a valid key, but the rejection message interpolates the expected key before die(). When the victim has CloneSite configured with a remote cloneSiteURL (standard federation/backup setup), the leaked myKey is exactly the credential that authenticates the victim to that remote server's cloneServer.json.php, allowing the attacker to impersonate the victim and trigger a full mysqldump of the remote's database to the remote's public videos/clones/ directory Commit e6566f56a28f4556b2a0a09d03717a719dcb49da contains an updated fix.