CVE-2026-84481: WWBN AVideo Information Disclosure Flaw

CVE-2026-84481 Overview

CVE-2026-84481 is an information disclosure vulnerability affecting WWBN AVideo through version 30.0. The flaw resides in the MobileManager plugin's getConfiguration endpoint, which returns sensitive configuration data to unauthenticated visitors. Attackers can send an unauthenticated HTTP GET request to plugin/MobileManager/getConfiguration.json.php to retrieve TLS private key file paths, socket configuration details, platform version, and debug flags. This exposed data enables further targeted attacks against the AVideo deployment. The weakness is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated attackers can retrieve TLS key paths, socket configurations, platform version data, and debug flags from vulnerable AVideo instances.

Affected Products

WWBN AVideo through version 30.0
AVideo MobileManager plugin
getConfiguration.json.php endpoint

Discovery Timeline

2026-09-01 - CVE-2026-84481 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84481

Vulnerability Analysis

The vulnerability lies in the MobileManager plugin shipped with WWBN AVideo through version 30.0. The getConfiguration.json.php endpoint exposes application configuration data without enforcing authentication or authorization checks. Any remote visitor can query the endpoint and receive a JSON document containing operational secrets and infrastructure metadata.

Disclosed fields include filesystem paths to TLS private keys, socket configuration values used by the mobile backend, the running platform version, and debug flags. These data points allow attackers to fingerprint the environment, map internal services, and prioritize follow-on exploitation attempts against the disclosed components.

Root Cause

The root cause is missing access control on a plugin endpoint that serves configuration data. The handler returns configuration state directly to the caller instead of restricting responses to authenticated administrative sessions. No session token, API key, or role check gates the request.

Attack Vector

Exploitation requires only network access to the AVideo web interface. An attacker issues an unauthenticated GET request to plugin/MobileManager/getConfiguration.json.php and parses the JSON response. See the GitHub Security Advisory GHSA-5jfh-mcm7-299m and the Vulncheck Advisory on AVideo for reference details. No verified public proof-of-concept code is available at time of publication.

Detection Methods for CVE-2026-84481

Indicators of Compromise

HTTP GET requests to plugin/MobileManager/getConfiguration.json.php from unauthenticated or unexpected client sources.
Anomalous access patterns to /plugin/MobileManager/ paths in web server or reverse proxy logs.
Outbound reconnaissance targeting TLS key paths or socket endpoints previously disclosed by the vulnerable endpoint.

Detection Strategies

Alert on any successful HTTP 200 response from getConfiguration.json.php where the request lacks a valid session cookie.
Baseline legitimate mobile client traffic and flag deviations in User-Agent, geography, or request frequency.
Correlate access to the vulnerable endpoint with subsequent probing of disclosed TLS or socket infrastructure.

Monitoring Recommendations

Ingest AVideo web server access logs into a centralized analytics platform and retain request paths and source IPs.
Monitor for scanner signatures targeting MobileManager and other AVideo plugin endpoints.
Track configuration file access on the host to identify downstream reads of disclosed key material.

How to Mitigate CVE-2026-84481

Immediate Actions Required

Restrict network access to plugin/MobileManager/getConfiguration.json.php at the web server or reverse proxy layer until an upstream fix is applied.
Rotate any TLS private keys whose file paths were exposed by the endpoint, since path disclosure aids targeted retrieval attempts.
Audit access logs for prior unauthenticated requests to the endpoint and investigate follow-on activity.

Patch Information

Refer to the GitHub Security Advisory GHSA-5jfh-mcm7-299m for upstream remediation guidance. Administrators should track the AVideo repository for a fixed release that adds authentication to the MobileManager configuration endpoint.

Workarounds

Disable the MobileManager plugin if mobile client integration is not required.
Add a web server rule that denies unauthenticated requests to getConfiguration.json.php, for example via an Nginx location block or Apache <Location> directive with Require valid-user.
Place AVideo behind a reverse proxy that enforces authentication on plugin management endpoints.

bash

# Example Nginx configuration to block unauthenticated access
location ~ ^/plugin/MobileManager/getConfiguration\.json\.php$ {
    deny all;
    return 403;
}