AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024`

MEDIO 5.3CVE-2026-45620 · GHSA-vpfx-pxqw-2w79 · Published 29/05/2026 · updated 21/07/2026

In breve

CVE-2026-45620 è una vulnerabilità MEDIO (CVSS 5.3) che riguarda WWBN/AVideo, avideo (wwbn).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.19%, superiore al 9.0% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
WWBN/AVideo Packagist	`≤ 29.0`	No fix yet
avideo wwbn	`≤ 29.0`	No fix yet

Description

CVE-2026-43881 fix d9cdc7024 patched users.json.php only. The same anti-pattern survives at master HEAD in:

objects/mention.json.php:17     $ignoreAdmin = true;
objects/mention.json.php:18     $users = User::getAllUsers($ignoreAdmin,
                                    ['name', 'email', 'user', 'channelName'], 'a');

No User::loginCheck(), no admin gate. Only entry guard: preg_match('/^@/', $_REQUEST['term']) and hard-coded rowCount=10.

NVD description

WWBN AVideo is an open source video platform. In 29.0 and earlier, objects/mention.json.php has no User::loginCheck() or admin gate. It only has an entry guard: preg_match('/^@/', $_REQUEST['term']) and hard-coded rowCount=10. This enables unauthenticated user enumeration.

References

WWBN/AVideo security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-45620 · ADVISORY
WWBN/AVideo · PACKAGE
GitHub Advisory GHSA-6rvw-7p8v-mjfq · ADVISORY

Altre vulnerabilità di WWBN/AVideo

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

WWBN/AVideo

Packagist

≤ 29.0

No fix yet

avideo

wwbn

≤ 29.0

No fix yet

Description

CVE-2026-43881 fix d9cdc7024 patched users.json.php only. The same anti-pattern survives at master HEAD in:

objects/mention.json.php:17     $ignoreAdmin = true;
objects/mention.json.php:18     $users = User::getAllUsers($ignoreAdmin,
                                    ['name', 'email', 'user', 'channelName'], 'a');

No User::loginCheck(), no admin gate. Only entry guard: preg_match('/^@/', $_REQUEST['term']) and hard-coded rowCount=10.

NVD description

Altre vulnerabilità di WWBN/AVideo

Vedi tutto →