In WWBN AVideo versions up to 26.0, the install/test.php diagnostic script's intended CLI-only access control is disabled by commenting out the die() statement, leaving the script accessible over HTTP after installation. This results in unauthorized exposure of sensitive information including video viewer IP addresses, session IDs, and user agents to unauthenticated visitors. The vulnerability is tracked as CVE-2026-35449 and is categorized under CWE-200. The CVSS 3.1 base score is 5.3, reflecting a medium impact primarily due to confidentiality loss without integrity or availability impact. No vendor advisory or patch is currently available, and the product is not a cloud service, so remediation depends on vendor updates or user intervention.

The vulnerability allows unauthenticated attackers to access sensitive information related to video viewers, such as IP addresses, session IDs, and user agents. This exposure can lead to privacy violations and potential user tracking but does not affect data integrity or system availability. The medium CVSS score reflects the limited scope of impact to confidentiality only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the install/test.php script, for example by removing or securing the script manually or restricting HTTP access to it. Monitor vendor communications for updates or patches addressing this vulnerability.