WWBN AVideo, an open source video platform, contains a vulnerability in versions up to and including 29.0 where unauthenticated users can access the APISecret by reading objects/plugins.json.php. This secret can then be used to invoke protected API endpoints without logging in, effectively bypassing authentication controls. The issue is tracked as CVE-2026-43885 with a CVSS 4.0 base score of 7.7 (high severity). A code commit (1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b) includes a fix, but no official vendor advisory or patch link is provided in the available data.

An attacker can obtain sensitive API secrets without authentication, allowing unauthorized access to protected API functions such as retrieving user lists. This could lead to exposure of user information and potential further unauthorized actions within the platform. The vulnerability compromises confidentiality and access control.

A fix has been committed in the source code (commit 1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b). However, no official patch or vendor advisory is currently available to confirm the release status. Users should update to a version including this commit once it is officially released. Until then, restrict access to the affected JSON endpoint if possible and monitor for updates from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.