CVE-2026-35452 PUBLISHED

WWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php

Assigner: GitHub_M
Reserved: 02.04.2026 Published: 06.04.2026 Updated: 06.04.2026

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory enforces User::isAdmin(). The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 5.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	WWBN
Product	AVideo
Versions	Version <= 26.0 is affected

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-99j6-hj87-6fcf

Problem Types

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE