CVE-2026-45620: Wwbn Avideo Auth Bypass Vulnerability

CVE-2026-45620 Overview

CVE-2026-45620 is an information disclosure vulnerability in WWBN AVideo, an open source video platform. The flaw exists in objects/mention.json.php, which lacks both User::loginCheck() and an administrative authorization gate. The endpoint only enforces an entry guard using preg_match('/^@/', $_REQUEST['term']) and a hard-coded rowCount=10. This design allows unauthenticated attackers to enumerate valid usernames on affected instances. The issue impacts AVideo version 29.0 and earlier and falls under CWE-204: Observable Response Discrepancy.

Critical Impact
Remote attackers can enumerate registered AVideo users without authentication, exposing identity data that supports targeted credential stuffing and phishing campaigns.

Affected Products

WWBN AVideo 29.0
WWBN AVideo versions prior to 29.0
Deployments exposing objects/mention.json.php to the public internet

Discovery Timeline

2026-05-29 - CVE-2026-45620 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-45620

Vulnerability Analysis

The vulnerability resides in the mention auto-complete endpoint objects/mention.json.php. AVideo uses this endpoint to suggest usernames when an authenticated user types @ in comments or chat. The endpoint queries the user table and returns up to ten matching account records as JSON. Because the file does not invoke User::loginCheck() or any administrative gate, any unauthenticated client can submit requests. The only restriction is a regular expression requiring the term parameter to start with @. An attacker can iterate through letter prefixes such as @a, @b, @ab to harvest valid usernames across the platform.

Root Cause

The root cause is missing authentication on a sensitive data endpoint. Standard AVideo controllers wrap user data lookups behind User::loginCheck(), but mention.json.php omits this control. The hard-coded rowCount=10 was treated as sufficient rate limiting, yet it does not prevent enumeration because attackers can vary the search term to retrieve different result sets. The pattern matches CWE-204, where response content reveals whether queried identities exist.

Attack Vector

Exploitation requires only network access to the AVideo instance. An attacker sends HTTP requests to objects/mention.json.php with the term parameter prefixed by @. The server responds with JSON containing usernames matching the prefix. By systematically varying the prefix, an attacker compiles a comprehensive list of registered accounts. Enumerated usernames feed downstream attacks including password spraying, credential stuffing, and targeted phishing against platform users.

No verified proof-of-concept code is published. Refer to the GitHub Security Advisory GHSA-vpfx-pxqw-2w79 for vendor-confirmed technical details.

Detection Methods for CVE-2026-45620

Indicators of Compromise

High-volume GET or POST requests to objects/mention.json.php from a single source address
Sequential term parameter values iterating through alphabetic prefixes such as @a, @b, @c
Requests to the mention endpoint originating from sessions that never authenticated
Spikes in JSON responses returning user records to anonymous clients

Detection Strategies

Inspect web server access logs for unauthenticated calls to objects/mention.json.php and alert on burst patterns
Deploy a WAF rule that flags requests to the mention endpoint without a valid session cookie
Baseline normal mention endpoint traffic and alert on deviations exceeding typical user behavior
Correlate enumeration attempts with subsequent failed login bursts to detect chained attacks

Monitoring Recommendations

Forward AVideo web logs to a centralized SIEM and create a rule for repeated mention.json.php access
Track the ratio of unique term values per source IP over rolling time windows
Monitor for follow-on authentication failures against enumerated usernames
Review CDN or reverse proxy logs for bot traffic targeting JSON endpoints

How to Mitigate CVE-2026-45620

Immediate Actions Required

Upgrade WWBN AVideo to a version later than 29.0 that includes the vendor fix referenced in GHSA-vpfx-pxqw-2w79
Restrict access to objects/mention.json.php at the web server or WAF layer until patching completes
Audit web logs for prior enumeration activity and rotate credentials of any accounts that show suspicious follow-on login attempts

Patch Information

WWBN released a security advisory through GitHub. Review the WWBN AVideo Security Advisory GHSA-vpfx-pxqw-2w79 for the fixed version and patch commit details. The fix adds an authentication check to the mention endpoint so only logged-in users can query username suggestions.

Workarounds

Block unauthenticated requests to objects/mention.json.php using a reverse proxy or WAF rule that requires a valid session cookie
Add a server-side require_once for the AVideo authentication helper and enforce User::loginCheck() at the top of the affected file as a temporary patch
Rate limit requests to JSON endpoints by source IP to slow enumeration attempts
Enforce account lockout and multi-factor authentication to reduce the value of harvested usernames

bash

# Example nginx configuration to block unauthenticated access to the mention endpoint
location = /objects/mention.json.php {
    if ($cookie_PHPSESSID = "") {
        return 403;
    }
    limit_req zone=mention_zone burst=5 nodelay;
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php/php-fpm.sock;
}