CVE-2026-45620: WWBN AVideo User Enumeration Vulnerability (Medium)

Technical summary

The vulnerability exists in the `objects/mention.json.php` file, which implements only a basic entry guard using a regex pattern (`preg_match('/^@/', $_REQUEST['term'])`) and a hard-coded `rowCount=10` parameter. Critically, the endpoint contains neither `User::loginCheck()` nor administrative authorization gates, allowing unauthenticated HTTP requests to query user data. CWE-204 (Observable Discrepancy) and CWE-285 (Improper Authorization) classify the underlying issues: the endpoint reveals user existence through response differentiation without requiring authentication.

Business impact

User enumeration may seem low-impact in isolation, but it serves as reconnaissance for larger attack campaigns. Threat actors can build comprehensive username lists for the target organization, enabling credential attacks, spear-phishing tailored to real usernames, or social engineering. For enterprises running AVideo internally (e.g., corporate video platforms or media organizations), this can expose organizational structure and employee names to external adversaries. The cumulative risk increases if combined with password spray or breach data correlation attacks.

Affected systems

WWBN AVideo version 29.0 and earlier are affected. Organizations running this self-hosted video platform should verify their installed version immediately. Later versions (if available) should be checked against vendor advisories for confirmation of remediation.

Exploitability

Exploitability is straightforward and requires no authentication, special privileges, or user interaction. An attacker with network access to the AVideo instance can repeatedly call the endpoint with varying input parameters to enumerate users. The attack is network-accessible (AV:N) and of low complexity (AC:L), making it a practical reconnaissance vector for any external threat actor.

Remediation

Upgrade WWBN AVideo to a patched version that implements proper authentication checks (User::loginCheck()) and role-based authorization before returning user data from the mention endpoint. Verify the specific patch version in the WWBN advisory. As an interim mitigation, restrict network access to the `objects/mention.json.php` endpoint via firewall rules or reverse proxy, or disable the endpoint if not critical to operations.

Patch guidance

Consult the official WWBN AVideo release notes and security advisories for the recommended patch version. Patches should include authentication enforcement and removal or hardening of the entry guard. Test patches in a non-production environment before deployment to ensure compatibility with existing customizations or third-party integrations. Document the patching date for compliance records.

Detection guidance

Monitor logs for repeated requests to `objects/mention.json.php` with varying `term` parameters, especially those prefixed with '@' (matching the regex pattern). High-frequency requests from a single source IP to this endpoint are suspicious. Implement alerting for HTTP 200 responses with user data returned from unauthenticated contexts. Consider deploying a Web Application Firewall (WAF) rule to flag or block requests to this endpoint from non-authenticated sessions.

Why prioritize this

Although classified as MEDIUM severity (CVSS 5.3), this vulnerability should not be deprioritized. User enumeration is a foundational reconnaissance technique; patching closes an information leak that attackers actively exploit in multi-stage campaigns. Organizations with public-facing AVideo instances or those in regulated industries (media, finance) should prioritize remediation to reduce reconnaissance surface area.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects low attack complexity, no privilege requirement, and network accessibility, balanced against limited confidentiality impact (usernames alone) and no integrity or availability impact. However, the practical risk is elevated by the endpoint's unauthenticated nature and the role of user enumeration in attack chains; scoring reflects the vulnerability in isolation rather than its use as a stepping stone.

Frequently asked questions