CVE-2026-84481: WWBN AVideo through 30.0 Information Disclosure via MobileManager
WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data to unauthenticated visitors. Attackers can send an unauthenticated GET request to plugin/MobileManager/getConfiguration.json.php to obtain TLS private key file paths, socket configuration details, platform version, and debug flags enabling further targeted attacks.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker only needs network access to the affected AVideo instance and can make an unauthenticated GET request to plugin/MobileManager/getConfiguration.json.php. No authentication is required.
Are default or publicly accessible deployments affected?
Any affected deployment where the MobileManager getConfiguration endpoint is reachable by an unauthenticated visitor is exposed. The provided information does not identify configuration prerequisites beyond access to that endpoint.
What information can be exposed?
The endpoint can disclose TLS private-key file paths, socket configuration details, the platform version, and debug flags. This information can support more targeted follow-on attacks.
How can I check whether an instance is vulnerable?
Request plugin/MobileManager/getConfiguration.json.php without authenticating and determine whether it returns configuration data. A response containing the described sensitive fields indicates exposure.