CVE-2026-35452: WWBN AVideo Information Disclosure Flaw

CVE-2026-35452 Overview

CVE-2026-35452 is an Information Exposure vulnerability affecting WWBN AVideo, an open source video platform. In versions 26.0 and prior, the plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. While every other endpoint in the CloneSite plugin directory enforces User::isAdmin(), this particular endpoint lacks proper access controls. The exposed log contains sensitive internal filesystem paths, remote server URLs, and SSH connection metadata.

Critical Impact

Unauthenticated attackers can access sensitive system information including internal filesystem paths, remote server URLs, and SSH connection metadata, potentially facilitating further attacks against the infrastructure.

Affected Products

• WWBN AVideo versions 26.0 and prior

Discovery Timeline

• 2026-04-06 - CVE CVE-2026-35452 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-35452

Vulnerability Analysis

This vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The flaw exists in the CloneSite plugin of WWBN AVideo, where the client.log.php endpoint fails to implement the same authentication checks present in other plugin endpoints.

The vulnerability allows network-based attackers to access sensitive log data without requiring any authentication or user interaction. While the direct impact is limited to information disclosure (confidentiality breach), the exposed data could serve as valuable reconnaissance for crafting subsequent attacks against the affected system.

Root Cause

The root cause is an inconsistent application of access controls within the CloneSite plugin. While other endpoints in the plugin directory properly enforce administrator authentication via User::isAdmin(), the client.log.php endpoint was inadvertently left unprotected. This oversight allows any remote user to directly request the clone operation log file.

Attack Vector

The attack vector is network-based with low complexity. An attacker can exploit this vulnerability by simply sending an unauthenticated HTTP request to the plugin/CloneSite/client.log.php endpoint. No special privileges, user interaction, or complex exploitation techniques are required. Upon successful exploitation, the attacker gains access to the log file contents, which may include:

• Internal filesystem paths revealing server directory structure
• Remote server URLs used in clone operations
• SSH connection metadata that could expose authentication details or server configurations

The vulnerability is particularly concerning in environments where the AVideo platform is internet-facing, as any remote attacker could potentially harvest this information for further reconnaissance or attacks.

Detection Methods for CVE-2026-35452

Indicators of Compromise

• Unusual or unexpected HTTP requests to the plugin/CloneSite/client.log.php endpoint
• Access logs showing requests to the vulnerable endpoint from unfamiliar IP addresses
• Multiple sequential requests to the CloneSite plugin endpoints indicating reconnaissance activity

Detection Strategies

• Monitor web server access logs for requests to plugin/CloneSite/client.log.php from unauthenticated sessions
• Implement web application firewall (WAF) rules to alert on access attempts to the vulnerable endpoint
• Review authentication patterns in the CloneSite plugin directory for any bypasses

Monitoring Recommendations

• Enable verbose logging for the AVideo application to track access patterns
• Set up alerts for access to sensitive plugin endpoints without valid admin session tokens
• Regularly audit access control implementations across all plugin endpoints

How to Mitigate CVE-2026-35452

Immediate Actions Required

• Restrict access to the plugin/CloneSite/client.log.php endpoint via web server configuration
• Review and rotate any credentials that may have been exposed in clone operation logs
• Consider temporarily disabling the CloneSite plugin if not actively required

Patch Information

Organizations should monitor the GitHub Security Advisory for official patch releases. Until a patch is available, implement the workarounds described below.

Workarounds

• Add .htaccess rules or equivalent web server configuration to deny access to the vulnerable endpoint
• Implement network-level access controls to limit who can reach the AVideo administration paths
• Deploy a reverse proxy with authentication requirements for sensitive plugin directories

# Apache .htaccess workaround to block access to vulnerable endpoint
<Files "client.log.php">
    Require all denied
</Files>

# Alternative: Restrict entire CloneSite plugin to authenticated admins
<Directory "/path/to/avideo/plugin/CloneSite">
    Require valid-user
</Directory>