In WWBN AVideo versions 26.0 and prior, the install/test.php diagnostic script has its intended CLI-only access restriction disabled by commenting out the die() statement that would normally block HTTP access. As a result, this script remains accessible over HTTP after installation, exposing sensitive video viewer statistics including IP addresses, session IDs, and user agent strings to unauthenticated visitors. This constitutes an information disclosure vulnerability categorized under CWE-200. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact with network attack vector, low attack complexity, no privileges required, no user interaction, and confidentiality impact only.

The vulnerability allows unauthenticated attackers to access sensitive information such as IP addresses, session IDs, and user agents of video viewers. This exposure could potentially aid in user tracking or profiling but does not directly impact integrity or availability. There are no known exploits in the wild, and the impact is limited to confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the install/test.php script, for example by removing or securing the script, or by implementing web server access controls to prevent unauthorized HTTP access to this diagnostic endpoint.