Vulnerability · Published Sep 1, 2026 · Assigned by VulnCheck

CVE-2026-84481WWBN AVideo through 30.0 Information Disclosure via MobileManager

Medium 6.9

In plain English

A medium-severity information exposure in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.4%top 61.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data to unauthenticated visitors. Attackers can send an unauthenticated GET request to plugin/MobileManager/getConfiguration.json.php to obtain TLS private key file paths, socket configuration details, platform version, and debug flags enabling further targeted attacks.

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	0 – through 30.0

Weakness: CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

GitHub Security Advisory (GHSA-5jfh-mcm7-299m) vendor-advisory
VulnCheck Advisory: WWBN AVideo through 30.0 Information Disclosure via MobileManager third-party-advisory