CVE-2026-84481: Exposure of Sensitive Information to an Unauthorized Actor in WWBN AVideo

CVE-2026-84481 is an information disclosure vulnerability in WWBN AVideo (up to version 30.0) affecting the MobileManager plugin's getConfiguration endpoint. An unauthenticated GET request to plugin/MobileManager/getConfiguration.json.php returns sensitive configuration details such as TLS private key file paths, socket configuration, platform version, and debug flags. This data exposure could aid attackers in crafting further attacks against the platform. The vulnerability is publicly known but no official fix or patch has been documented as of the publication date.

Sensitive configuration information, including TLS private key file paths and debug flags, is exposed to unauthenticated users. This could enable attackers to gain insights into the system's security posture and potentially facilitate further attacks. However, there is no indication of direct code execution or privilege escalation from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the MobileManager plugin endpoints if possible, and monitor for suspicious access patterns. Avoid exposing sensitive configuration endpoints to unauthenticated users.