The vulnerability in WWBN AVideo (<= 26.0) involves an unauthenticated endpoint (plugin/API/check.ffmpeg.json.php) that allows probing of FFmpeg remote server configuration and returns connectivity status without any authentication checks. Other related FFmpeg management endpoints enforce admin-level authentication via User::isAdmin(), but this particular endpoint does not, leading to missing authentication for a critical function. This could allow an unauthenticated attacker to gain information about the FFmpeg server connectivity status, potentially aiding further reconnaissance.

The impact is limited to disclosure of FFmpeg remote server connectivity status without authentication. There is no indication of integrity or availability impact, nor evidence of remote code execution or privilege escalation. The CVSS vector indicates no privileges required, no user interaction needed, and only low confidentiality impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — no official fix or remediation level is provided by the vendor. Users should monitor the vendor advisory for updates. Until a patch is available, restricting access to the vulnerable endpoint via network controls or web application firewall rules may reduce exposure. Since other FFmpeg endpoints require admin authentication, reviewing and enforcing consistent authentication on all management endpoints is recommended once a fix is released.