CVE-2026-45620 affects WWBN AVideo (<= 29.0) due to insufficient access control in the objects/mention.json.php file. The endpoint does not enforce user login or admin privileges and only uses a basic regex check on the 'term' request parameter. This allows unauthenticated attackers to enumerate users by observing response discrepancies. The vulnerability is categorized under CWE-204 (Observable Response Discrepancy) and CWE-285 (Improper Authorization). No known exploits are reported, and no official fix has been published.

An unauthenticated attacker can enumerate users on affected WWBN AVideo instances by exploiting the lack of proper authentication and authorization checks in the mention.json.php endpoint. This can lead to privacy concerns and potentially facilitate further targeted attacks. The impact is limited to information disclosure (user enumeration) without direct integrity or availability effects.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected endpoint or implementing custom authentication checks to prevent unauthenticated user enumeration.