CVE-2026-43885: AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization

May 5, 2026 (updated May 13, 2026)

An unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints (e.g. users_list) without logging in.

References

github.com/WWBN/AVideo/commit/1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b
github.com/WWBN/AVideo/security/advisories/GHSA-xr49-f4rh-qcjf
github.com/advisories/GHSA-xr49-f4rh-qcjf
nvd.nist.gov/vuln/detail/CVE-2026-43885

Code Behaviors & Features

Detect and mitigate CVE-2026-43885 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →