In WWBN AVideo versions 26.0 and prior, the endpoint plugin/API/check.ffmpeg.json.php allows unauthenticated users to probe the FFmpeg remote server configuration and retrieve connectivity status. This endpoint lacks the User::isAdmin() authentication check that is enforced on other related FFmpeg management endpoints such as kill.ffmpeg.json.php, list.ffmpeg.json.php, and ffmpeg.php. This missing authentication represents a CWE-306 vulnerability, potentially exposing sensitive configuration information to unauthorized users. The vulnerability has a CVSS 3.1 score of 5.3, reflecting a medium impact primarily due to information disclosure without integrity or availability impact. No vendor advisory or patch information is currently available.

The vulnerability allows unauthenticated attackers to obtain FFmpeg remote server connectivity status information, which could aid in reconnaissance or further attacks. There is no direct impact on data integrity or availability reported. The exposure is limited to connectivity status information, which is considered a low to medium confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable endpoint via network controls or web application firewalls to prevent unauthenticated access. Monitoring for unusual access patterns to this endpoint may also be prudent.