CVE-2026-81732: WWBN AVideo through 30.0 Information Disclosure via report4.json.php
WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to user registration statistics. Attackers can send GET requests to these endpoints to retrieve daily and cumulative user-registration counts without any session or authorization.
Affected Software
Event History
Frequently Asked Questions
Who can access the exposed registration statistics?
Any unauthenticated remote party able to reach the affected AVideo endpoints can retrieve the data. No session or authorization is required.
What information can an attacker obtain?
The exposed endpoints return daily and cumulative user-registration counts. The provided information does not indicate exposure of individual user records or credentials.
How can I verify whether an instance is affected?
Send an unauthenticated GET request to report4.json.php or report4.1.json.php on the AVideo instance. If either endpoint returns registration statistics without requiring authentication, the instance is affected.