CVE-2026-84481 in AVideo
Summary
by MITRE • 09/02/2026
WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data to unauthenticated visitors. Attackers can send an unauthenticated GET request to plugin/MobileManager/getConfiguration.json.php to obtain TLS private key file paths, socket configuration details, platform version, and debug flags enabling further targeted attacks.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in WWBN AVideo versions up through 30.0 represents a critical information disclosure flaw located within the MobileManager plugin's getConfiguration endpoint. This security deficiency allows unauthenticated external actors to access sensitive internal configuration data that should be restricted to authorized administrators or system processes. The core technical issue stems from an improper implementation of access controls on the specific API endpoint, which fails to verify the authentication status of incoming requests before serving its response payload. Consequently, any individual with network connectivity to the AVideo instance can exploit this misconfiguration by sending a simple GET request to the path plugin/MobileManager/getConfiguration.json.php without providing valid credentials or session tokens.
The data exposed through this vulnerability includes highly sensitive operational details that significantly expand the attack surface for potential adversaries. Specifically, the response reveals file paths associated with TLS private keys, which can aid attackers in locating certificate files on the server filesystem if they gain any form of local access later. Additionally, socket configuration details are disclosed, providing insights into network binding addresses and ports used by internal services. The exposure of platform version information allows for precise identification of the software stack, enabling attackers to cross-reference known vulnerabilities associated with that specific release. Furthermore, debug flags being returned indicate whether verbose logging or diagnostic modes are active, which can reveal additional error messages during subsequent exploitation attempts that might leak further system internals such as database connection strings or internal IP addresses.
From an operational impact perspective, this vulnerability facilitates reconnaissance and pre-exploitation activities for remote attackers. By gathering these configuration artifacts, adversaries can map the infrastructure more accurately than through generic scanning techniques alone. The knowledge of TLS key locations could theoretically assist in file inclusion attacks if combined with other vulnerabilities like local file inclusion or path traversal flaws present elsewhere in the application. Debug flags being enabled often correlate with less secure default configurations that may expose stack traces during errors, thereby accelerating the discovery of additional weaknesses such as SQL injection points or cross-site scripting vectors. This level of information leakage effectively lowers the barrier for entry, allowing attackers to tailor their exploits specifically against the identified version and configuration state rather than relying on broad-spectrum attacks.
This vulnerability aligns with CWE-200, which defines Information Exposure, where sensitive information is disclosed without proper access controls. It also maps to MITRE ATT&CK technique T1592, Gather Victim Host Information, specifically sub-technique T1592.001 for Gathering Active Directory Data or generally host configuration gathering in non-domain environments. The exploitation method corresponds to automated discovery techniques where attackers probe endpoints to enumerate system properties and service configurations prior launching targeted attacks against identified services.
Mitigation strategies should prioritize immediate patching of the AVideo installation to a version newer than 30.0, as this issue has been addressed by the vendor in subsequent releases. In environments where upgrading is not immediately feasible, administrators must implement network-level access controls such as firewall rules or reverse proxy configurations that restrict access to the plugin/MobileManager/getConfiguration.json.php endpoint exclusively to trusted internal IP addresses or administrative subnets. Additionally, it is crucial to audit all active plugins for similar misconfigurations and ensure that debug modes are disabled in production environments to prevent the leakage of diagnostic data. Regular security audits focusing on API authentication checks across all exposed endpoints will help identify and remediate similar access control failures before they can be exploited by malicious actors seeking to gain deeper insight into the system architecture.