CVE-2026-45620: AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration
CVE-2026-43881 fix d9cdc7024 patched users.json.php only. The same anti-pattern survives at master HEAD in:
objects/mention.json.php:17 $ignoreAdmin = true; objects/mention.json.php:18 $users = User::getAllUsers($ignoreAdmin, ['name', 'email', 'user', 'channelName'], 'a');
No User::loginCheck(), no admin gate. Only entry guard: pregmatch('/^@/', $REQUEST['term']) and hard-coded rowCount=10.
Other sources
WWBN AVideo is an open source video platform. In 29.0 and earlier, objects/mention.json.php has no User::loginCheck() or admin gate. It only has an entry guard: pregmatch('/^@/', $REQUEST['term']) and hard-coded rowCount=10. This enables unauthenticated user enumeration.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45620?
CVE-2026-45620 is considered a critical vulnerability due to potential unauthorized access to user data.
How do I fix CVE-2026-45620?
To fix CVE-2026-45620, you should update the WWBN/AVideo package to a version higher than 29.0.
What types of systems are affected by CVE-2026-45620?
CVE-2026-45620 affects systems running the WWBN/AVideo package version 29.0 or below.
What is the impact of CVE-2026-45620?
The impact of CVE-2026-45620 includes potential exposure of sensitive user information such as names and emails.
Is there a known exploit for CVE-2026-45620?
As of now, there are no publicly disclosed exploits specifically for CVE-2026-45620.