CVE-2026-45620 — AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration

CVE-2026-45620

AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration PUBLISHED

Description (CNA)

WWBN AVideo is an open source video platform. In 29.0 and earlier, objects/mention.json.php has no User::loginCheck() or admin gate. It only has an entry guard: preg_match('/^@/', $_REQUEST['term']) and hard-coded rowCount=10. This enables unauthenticated user enumeration.

Affected (CNA)

Vendor / product	Versions
WWBN / AVideo	affected <= 29.0

CWE

CWE-204, CWE-285

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-vpfx-pxqw-2w79

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.