What is CVE-2026-35449?

CVE-2026-35449 is a medium-severity vulnerability in Wwbn Avideo, classified under Information Disclosure. CVSS score: 5.3/10. Published 2026-04-06.

How severe is CVE-2026-35449?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Information disclosure in Wwbn Avideo

CVE-2026-35449

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the install/test.php diagnostic script has its CLI-only access guard disabled by commenting out the die() statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP addresses, session IDs, and user agents to unauthenticated visitors.

Vulnerability class: Information Disclosure

EPSS: 0.003 (25.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Wwbn Avideo — versions <= 26.0

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2026-35449?: CVE-2026-35449 is a medium-severity vulnerability in Wwbn Avideo, classified under Information Disclosure. CVSS score: 5.3/10. Published 2026-04-06.
How severe is CVE-2026-35449?: Medium severity. CVSS v3 base score is 5.3 out of 10.