WWBN AVideo versions up to 29.0 contain an information disclosure vulnerability (CWE-204) in the objects/mention.json.php file. This endpoint does not enforce authentication or authorization, relying solely on a pattern match for input and a hard-coded row count limit. As a result, unauthenticated attackers can enumerate users by querying this endpoint, potentially aiding further targeted attacks. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, no privileges required, no user interaction, and limited confidentiality impact.

The vulnerability allows unauthenticated attackers to enumerate user accounts on affected WWBN AVideo instances. This information disclosure can facilitate targeted attacks such as phishing or brute force attempts. There is no direct impact on data integrity or system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint if possible or implement additional authentication checks to prevent unauthenticated access to objects/mention.json.php.