CVE-2026-35450: WWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php
Summary
The plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints (kill.ffmpeg.json.php, list.ffmpeg.json.php, ffmpeg.php) require User::isAdmin().
Details
The entire file at plugin/API/check.ffmpeg.json.php:
php <?php $configFile = DIR.'/../../videos/configuration.php'; requireonce $configFile; header('Content-Type: application/json');
$obj = testFFMPEGRemote();
die(jsonencode($obj));
No User::isAdmin(), User::isLogged(), or any access control check exists.
Compare with sibling endpoints in the same directory: - kill.ffmpeg.json.php checks User::isAdmin() - list.ffmpeg.json.php checks User::isAdmin()
Proof of Concept
bash curl "https://your-avideo-instance.com/plugin/API/check.ffmpeg.json.php"
Returns information about whether the platform uses a standalone FFmpeg server and its current reachability.
Impact
Infrastructure reconnaissance revealing the encoding architecture. Limited direct impact but aids targeted attack planning.
Recommended Fix
Add an admin authentication check at plugin/API/check.ffmpeg.json.php:3, after requireonce $configFile;:
php if (!User::isAdmin()) { forbiddenPage('Admin only'); }
--- Found by aisafe.io
Other sources
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints (kill.ffmpeg.json.php, list.ffmpeg.json.php, ffmpeg.php) require User::isAdmin().
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In plugin/API/check.ffmpeg.json.php, add an admin authentication check immediately after `require_once $configFile;` so the endpoint only proceeds when `User::isAdmin()` is true. Update the logic so non-admin users cannot reach/trigger the FFmpeg remote server status disclosure (connectivity/encoding infrastructure reconnaissance).
WWBN AVideo (plugin/API/check.ffmpeg.json.php) User::isAdmin() access control = Require admin authentication