CVE-2026-43873

WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/CloneSite/cloneClient.json.php echoes the local CloneSite shared secret ($objClone->myKey, a constant md5($global['systemRootPath'] . $global['salt'])) into the HTTP response body on every unauthenticated request. The unauthenticated error branch was intended to reject non-admin callers without a valid key, but the rejection message interpolates the expected key before die(). When the victim has CloneSite configured with a remote cloneSiteURL (standard federation/backup setup), the leaked myKey is exactly the credential that authenticates the victim to that remote server's cloneServer.json.php, allowing the attacker to impersonate the victim and trigger a full mysqldump of the remote's database to the remote's public videos/clones/ directory Commit e6566f56a28f4556b2a0a09d03717a719dcb49da contains an updated fix.

• CWE-209

• https://github.com/WWBN/AVideo/commit/e6566f56a28f4556b2a0a09d03717a719dcb49da
• https://github.com/WWBN/AVideo/security/advisories/GHSA-qm9p-p5pw-jrx2
• https://github.com/WWBN/AVideo/security/advisories/GHSA-qm9p-p5pw-jrx2

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-43868Memory Allocation with Excessive Size Value vulnerability in…5.3
• CVE-2026-43869Improper Validation of Certificate with Host Mismatch vulner…7.3
• CVE-2026-4387StrongDM Desktop Application before 23.74.0 (Desktop Client …2
• CVE-2026-43870Origin Validation Error, Improper Limitation of a Pathname t…7.3
• CVE-2026-43871Loop with Unreachable Exit Condition ('Infinite Loop') vulne…7.5
• CVE-2026-43872Actual is an open-source personal finance application. Prior…5.3
• CVE-2026-43874WWBN AVideo is an open source video platform. In versions up…7.2
• CVE-2026-43875WWBN AVideo is an open source video platform. In versions up…6.8
• CVE-2026-43876WWBN AVideo is an open source video platform. In versions up…6.4
• CVE-2026-43877WWBN AVideo is an open source video platform. In versions up…5.4
• CVE-2026-43878WWBN AVideo is an open source video platform. In versions up…6.1
• CVE-2026-43879WWBN AVideo is an open source video platform. In versions up…5.4