Sign in
Deutsch English Español Polski
Medium

AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php

  • Disclosed: 04.04.2026
  • Updated: 11.10.2026 10:22

Summary

The plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints (kill.ffmpeg.json.php, list.ffmpeg.json.php, ffmpeg.php) require User::isAdmin().

Details

The entire file at plugin/API/check.ffmpeg.json.php:

php
<?php
$configFile = __DIR__.'/../../videos/configuration.php';
require_once $configFile;
header('Content-Type: application/json');

$obj = testFFMPEGRemote();

die(json_encode($obj));

No User::isAdmin(), User::isLogged(), or any access control check exists.

Compare with sibling endpoints in the same directory:

  • kill.ffmpeg.json.php checks User::isAdmin()
  • list.ffmpeg.json.php checks User::isAdmin()

Proof of Concept

bash
curl "https://your-avideo-instance.com/plugin/API/check.ffmpeg.json.php"

Returns information about whether the platform uses a standalone FFmpeg server and its current reachability.

Impact

Infrastructure reconnaissance revealing the encoding architecture. Limited direct impact but aids targeted attack planning.

Recommended Fix

Add an admin authentication check at plugin/API/check.ffmpeg.json.php:3, after require_once $configFile;:

php
if (!User::isAdmin()) {
    forbiddenPage('Admin only');
}

Found by aisafe.io

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package wwbn/avideo <= 26.0 no fix

References

CVSS score 5.3/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE)
CWE-306
Platform
Composer
Package
wwbn/avideo
Disclosed
04.04.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-2vg4-rrx4-qcpq - CC BY 4.0

Vulnerability history: wwbn/avideo

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (160) in the archive
Total entries
160
First → latest
04.2022 06.2026
Without a fix
143
Exploited in attacks
0

Severity breakdown

  • Critical 14
  • High 61
  • Medium 83
  • Low 2

Disclosures per year

Severity:
  1. AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php this entry
    Medium · 5.3 CVE-2026-35450 <= 26.0 no fix
  2. AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink
    High · 8.1 CVE-2026-55173 <= 29.0 no fix
  3. AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration
    High · 7.5 CVE-2026-33692 < 29.0 29.0
  4. WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin
    Critical · 9.6 CVE-2026-54458 <= 29.0 no fix
  5. WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)
    High CVE-2026-49279 <= 29.0 no fix
  6. WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint
    High · 4.3 CVE-2026-47696 <= 29.0 no fix
  7. AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL
    High · 8.8 CVE-2026-45578 <= 29.0 no fix
  8. AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin
    High · 8.1 CVE-2026-56345 <= 29.0 no fix
  9. AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization
    High CVE-2026-43885 <= 29.0 no fix
  10. AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()
    High · 7.7 CVE-2026-43884 <= 29.0 no fix
  11. AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass
    High · 7.2 CVE-2026-43874 <= 29.0 no fix
  12. AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server
    High · 7.5 CVE-2026-43873 <= 29.0 no fix
  13. WWBN AVideo: RCE cause by clonesite plugin
    High · 9.8 CVE-2026-41304 <= 29.0 no fix
  14. WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection
    High · 9.3 CVE-2026-41064 <= 29.0 no fix
  15. WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL
    High · 7.7 CVE-2026-41060 <= 29.0 no fix
  16. WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses
    High · 7.1 CVE-2026-41057 <= 29.0 no fix
  17. WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover
    High · 8.1 CVE-2026-41056 <= 29.0 no fix
  18. WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script)
    High · 7.1 CVE-2026-40926 <= 29.0 no fix
  19. WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials
    High · 8.3 CVE-2026-40925 <= 29.0 no fix
  20. WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks
    Critical · 10.0 CVE-2026-40911 <= 29.0 no fix
  21. WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)
    High · 8.7 CVE-2026-40909 <= 29.0 no fix
Show more (20) Showing 21 of 76

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.