Description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the API plugin exposes a `decryptString` action without any authentication. Anyone can submit ciphertext and receive plaintext. Ciphertext is issued publicly (e.g., `view/url2Embed.json.php`), so any user can recover protected tokens/metadata. Commit 3fdeecef37bb88967a02ccc9b9acc8da95de1c13 contains a patch.
Scores
CVSS v3
7.5
EPSS
0.0003
EPSS Percentile
9.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-287
CWE-312
CWE-326
CWE-327
Status
published
Products (3)
wwbn/avideo
< 26.0
wwbn/avideo
0Packagist
WWBN/AVideo
<= 26.0
Published
Mar 23, 2026
Tracked Since
Mar 24, 2026