CVE-2026-89248 Details
Description
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json.php. When the WebRTC plugin is present, any unauthenticated remote user can request /plugin/WebRTC/status.json.php and receive JSON containing the absolute filesystem path of the WebRTC2RTMP helper binary (revealing the document-root path), the configured WebRTC port, file_exists/is_executable status for the binary, the contents of the WebRTC log/JSON files (videos/WebRTC2RTMP.log) when present, and whether the configured port is reachable on loopback (127.0.0.1) and on the public address. The endpoint performs no User::isLogged(), User::isAdmin(), or forbiddenPage() check. The issue was unfixed at the time of reporting.
A vulnerability exists in AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1, specifically within the WebRTC plugin. The issue arises from a lack of authentication and authorization checks in the file 'plugin/WebRTC/status.json.php'. This oversight allows any unauthenticated remote user to access the status.json.php endpoint and receive sensitive information in JSON format. The disclosed data includes the absolute filesystem path of the WebRTC2RTMP helper binary, the configured WebRTC port, the executable status of the binary, contents of the WebRTC log files when available, and the reachability of the configured port on both loopback and public addresses.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 11, 2026CISA-ADP
Assessed Sep 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-wqv3-v6h8-m9qx | CISA-ADP | AdvisoryExploitTechnical DescriptionVendor |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-wqv3-v6h8-m9qx | [email protected] | AdvisoryExploitTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/avideo-webrtc-plugin-information-disclosure-via-status-json-php | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WWBN/AVideo | <= c3edcc274c389816d434acadac07ee78eaf330c1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 11, 2026 | CVE Modified | CISA-ADP |
| Sep 11, 2026 | New CVE Received | [email protected] |