CVE-2026-81732

Medium

Description

WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to user registration statistics. Attackers can send GET requests to these endpoints to retrieve daily and cumulative user-registration counts without any session or authorization.

SeverityMedium

CVSS6.9

Exploit probability—

ProductAVideo

PublishedAug 28, 2026

First seenAug 28, 2026

Weakness typeCWE-200Sensitive information exposure

How to fix

Vendor advisories

github.com/WWBN/AVideo/security/advisories/GHSA-xv5m-gpmp-m72c

Affected products

Product	Affected versions	Fixed in
WWBN AVideo	v ≤ 30.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.