CVE-2026-35452 — WWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php

CVE-2026-35452

WWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php PUBLISHED

Description (CNA)

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory enforces User::isAdmin(). The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.

Affected (CNA)

Vendor / product	Versions
WWBN / AVideo	affected <= 26.0

CWE

CWE-200

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-99j6-hj87-6fcf

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.