CVE-2026-89248: AVideo WebRTC Information Disclosure Flaw

CVE-2026-89248 Overview

CVE-2026-89248 is an information disclosure vulnerability in AVideo, an open-source video streaming platform. The flaw resides in the WebRTC plugin endpoint plugin/WebRTC/status.json.php, which lacks authentication and authorization checks. Any unauthenticated remote user can query the endpoint and receive sensitive runtime data about the server. Disclosed information includes the absolute filesystem path of the WebRTC2RTMP helper binary, the configured WebRTC port, binary existence and executability status, the contents of videos/WebRTC2RTMP.log, and loopback and public reachability of the configured port. The issue is tracked under [CWE-200] and affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1.

Critical Impact
Unauthenticated remote attackers can enumerate the AVideo document-root path, service topology, and log contents, providing reconnaissance data useful for chaining further attacks.

Affected Products

AVideo platform through commit c3edcc274c389816d434acadac07ee78eaf330c1
Deployments with the WebRTC plugin enabled
The plugin/WebRTC/status.json.php endpoint specifically

Discovery Timeline

2026-09-11 - CVE-2026-89248 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89248

Vulnerability Analysis

The vulnerability stems from a missing access control check on the plugin/WebRTC/status.json.php endpoint. The script is intended to provide diagnostic status for the WebRTC plugin but is reachable without any session context. It does not invoke User::isLogged(), User::isAdmin(), or forbiddenPage() before returning its JSON payload. As a result, the endpoint exposes operational telemetry that should be restricted to administrators.

The returned JSON reveals the absolute filesystem path of the WebRTC2RTMP helper binary, which discloses the server document-root layout. It also reports file_exists and is_executable flags for that binary, the configured WebRTC port, and the contents of videos/WebRTC2RTMP.log when the log file is present. The endpoint additionally probes whether the configured port is reachable on 127.0.0.1 and on the public address, effectively performing an authenticated-style port check on behalf of the attacker.

Root Cause

The root cause is broken access control on a diagnostic endpoint. The developers did not apply the platform's existing authorization primitives to status.json.php. This omission allows the endpoint to leak internal filesystem, configuration, and log data to anonymous requesters.

Attack Vector

Exploitation requires only network access to the AVideo web server and no user interaction. An attacker sends an HTTP GET request to /plugin/WebRTC/status.json.php and parses the returned JSON. See the GitHub Security Advisory and the VulnCheck Advisory for reproduction details.

// No verified exploit code is published. Refer to the linked advisories for technical detail.

Detection Methods for CVE-2026-89248

Indicators of Compromise

Unauthenticated HTTP GET requests to /plugin/WebRTC/status.json.php in web server access logs.
JSON responses from that endpoint containing keys such as the WebRTC2RTMP binary path, port, and file_exists fields.
Requests originating from unfamiliar IP ranges or scanning tool user agents targeting the WebRTC plugin path.

Detection Strategies

Alert on any HTTP 200 response to /plugin/WebRTC/status.json.php where the request lacks an authenticated session cookie.
Correlate access to this endpoint with subsequent reconnaissance or exploitation attempts against paths revealed in the JSON output.
Review historical access logs for prior queries against the same endpoint to identify pre-disclosure probing.

Monitoring Recommendations

Ingest AVideo web server access logs into a centralized analytics platform for query and correlation.
Track outbound information from the videos/WebRTC2RTMP.log file for exposure indicators.
Monitor for follow-on scanning of the disclosed WebRTC port on both loopback proxies and the public interface.

How to Mitigate CVE-2026-89248

Immediate Actions Required

Restrict access to /plugin/WebRTC/status.json.php at the web server or reverse proxy layer until an upstream patch is available.
Disable the WebRTC plugin if it is not required for production streaming workloads.
Rotate or relocate any sensitive files exposed under the disclosed document-root path where feasible.

Patch Information

At the time of publication the issue was unfixed. Monitor the AVideo GitHub Security Advisory GHSA-wqv3-v6h8-m9qx and the VulnCheck advisory for patch availability. Apply the fix that adds User::isLogged(), User::isAdmin(), or forbiddenPage() checks to the endpoint once released.

Workarounds

Add a web server rule (nginx location block or Apache Files directive) that requires authentication or denies access to status.json.php.
Block the endpoint at an upstream WAF and allowlist only administrator IP ranges.
Remove or rename the plugin/WebRTC/status.json.php file if the plugin's diagnostic functionality is not in use.

bash

# nginx example: deny public access to the vulnerable endpoint
location = /plugin/WebRTC/status.json.php {
    allow 10.0.0.0/8;
    deny all;
}