CVE-2026-81732: WWBN AVideo Information Disclosure Flaw

CVE-2026-81732 Overview

CVE-2026-81732 is an information disclosure vulnerability in WWBN AVideo through version 30.0. The application fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints. Unauthenticated attackers can issue GET requests to these endpoints and retrieve daily and cumulative user-registration statistics. No session, token, or authorization check gates access to the reporting data. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Remote, unauthenticated attackers can enumerate user-registration metrics from vulnerable AVideo deployments, exposing platform growth data and supporting reconnaissance for targeted attacks.

Affected Products

WWBN AVideo through version 30.0
report4.json.php reporting endpoint
report4.1.json.php reporting endpoint

Discovery Timeline

2026-08-28 - CVE-2026-81732 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-81732

Vulnerability Analysis

WWBN AVideo is an open-source video streaming and content management platform. The reporting subsystem exposes JSON endpoints that aggregate user-registration counts for administrative dashboards. In affected releases, the endpoints report4.json.php and report4.1.json.php do not validate the requester's identity or role before returning data.

An attacker issues a standard HTTP GET request directly to either endpoint. The application responds with structured JSON containing daily and cumulative registration counts. This data is intended to be visible only to administrators reviewing platform analytics. Because the endpoints skip the authentication guard applied elsewhere in the admin console, they operate as open data feeds.

While the disclosed data does not include credentials or personally identifiable information (PII), it reveals operational metrics. Attackers can profile the platform's active user base, monitor growth trends, or time follow-on attacks such as credential stuffing to periods of high registration activity.

Root Cause

The root cause is a missing authorization check on two administrative reporting endpoints. The endpoints were deployed without the session validation logic used by parallel administrative routes, resulting in broken access control.

Attack Vector

Exploitation is remote and requires no privileges or user interaction. An attacker sends a GET request to https://<target>/plugin/Live/report4.json.php or the report4.1.json.php variant. The server returns aggregated user-registration data in JSON. The attack can be scripted to poll periodically and build a longitudinal view of registration activity. See the GitHub Security Advisory GHSA-xv5m-gpmp-m72c and the VulnCheck Advisory for AVideo for endpoint context.

Detection Methods for CVE-2026-81732

Indicators of Compromise

Unauthenticated HTTP GET requests to report4.json.php or report4.1.json.php in web server access logs
HTTP 200 responses returning JSON payloads containing registration counts to clients without an authenticated session cookie
Repeated polling of the reporting endpoints from a single external IP or a small set of IPs

Detection Strategies

Parse web server access logs for requests to the two reporting endpoints and correlate with the presence or absence of a valid session cookie or Authorization header.
Deploy web application firewall (WAF) rules that alert on external requests to /*/report4.json.php and /*/report4.1.json.php.
Baseline legitimate administrative traffic to the endpoints and flag deviations, particularly requests originating outside known administrator networks.

Monitoring Recommendations

Enable verbose access logging on the AVideo web tier and forward logs to a centralized SIEM or data lake for retention and correlation.
Monitor for enumeration patterns such as sequential requests, high request rates, or requests from cloud provider or anonymization service IP ranges.
Track outbound JSON response sizes from the reporting endpoints to identify sustained data exfiltration attempts.

How to Mitigate CVE-2026-81732

Immediate Actions Required

Restrict network access to report4.json.php and report4.1.json.php at the reverse proxy, WAF, or firewall layer until a vendor patch is applied.
Require an authenticated administrative session for any request reaching the reporting endpoints, enforced upstream of the PHP handler.
Review historical access logs for prior unauthenticated requests to determine whether reconnaissance has already occurred.

Patch Information

Refer to the GitHub Security Advisory GHSA-xv5m-gpmp-m72c for vendor-supplied remediation guidance. Upgrade beyond WWBN AVideo version 30.0 once a fixed release is available, and validate that the reporting endpoints reject unauthenticated requests.

Workarounds

Block direct external access to /plugin/Live/report4.json.php and /plugin/Live/report4.1.json.php using web server access control rules.
Add an authentication check in the reverse proxy configuration that requires a valid admin session cookie before proxying requests to the reporting paths.
Limit administrative interfaces to a trusted management network or VPN and remove them from public exposure.

bash

# Example nginx configuration to block unauthenticated access
location ~* /report4(\.1)?\.json\.php$ {
    allow 10.0.0.0/8;      # trusted admin network
    deny  all;
    return 403;
}