CVE-2026-43885 affects WWBN AVideo, an open source video platform, in versions up to 29.0. The vulnerability allows unauthenticated users to read the APISecret from the objects/plugins.json.php file, enabling unauthorized access to protected API endpoints such as users_list. This issue is due to improper access control and exposure of sensitive information. The vulnerability has a CVSS 4.0 base score of 7.7, indicating high severity. A fix has been committed in revision 1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b, though no official vendor advisory or patch link is provided in the data.

An attacker can obtain the APISecret without authentication, allowing them to call protected API endpoints that should require authorization. This can lead to unauthorized information disclosure or potential further unauthorized actions within the affected AVideo platform. There is no indication of known exploits in the wild at this time.

A fix is available as indicated by the referenced commit (1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b). Users of WWBN AVideo should update to a version including this fix or apply the changes from the commit to prevent unauthorized access to the APISecret. Patch status is not explicitly confirmed by a vendor advisory; therefore, users should verify the fix status with the official WWBN AVideo project repository or vendor channels before deployment.