CVE-2026-43873

{
  "id": "CVE-2026-43873",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-11T22:22:11.703",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/CloneSite/cloneClient.json.php echoes the local CloneSite shared secret ($objClone->myKey, a constant md5($global['systemRootPath'] . $global['salt'])) into the HTTP response body on every unauthenticated request. The unauthenticated error branch was intended to reject non-admin callers without a valid key, but the rejection message interpolates the expected key before die(). When the victim has CloneSite configured with a remote cloneSiteURL (standard federation/backup setup), the leaked myKey is exactly the credential that authenticates the victim to that remote server's cloneServer.json.php, allowing the attacker to impersonate the victim and trigger a full mysqldump of the remote's database to the remote's public videos/clones/ directory Commit e6566f56a28f4556b2a0a09d03717a719dcb49da contains an updated fix."
    },
    {
      "lang": "es",
      "value": "WWBN AVideo es una plataforma de video de código abierto. En versiones hasta la 29.0 inclusive, plugin/CloneSite/cloneClient.json.php devuelve el secreto compartido local de CloneSite ($objClone  ->  myKey, una constante md5($global[’systemRootPath’] . $global[’salt’])) en el cuerpo de la respuesta HTTP en cada solicitud no autenticada. La rama de error no autenticado estaba destinada a rechazar a los llamantes no administradores sin una clave válida, pero el mensaje de rechazo interpola la clave esperada antes de die(). Cuando la víctima tiene CloneSite configurado con una cloneSiteURL remota (configuración estándar de federación/copia de seguridad), la myKey filtrada es exactamente la credencial que autentica a la víctima en el cloneServer.json.php de ese servidor remoto, permitiendo al atacante suplantar a la víctima y activar un mysqldump completo de la base de datos del remoto en el directorio público videos/clones/ del remoto. El commit e6566f56a28f4556b2a0a09d03717a719dcb49da contiene una corrección actualizada."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "WWBN",
          "product": "AVideo",
          "versions": [
            {
              "version": "<= 29.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-12T12:56:05.654210Z",
          "id": "CVE-2026-43873",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-209"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/WWBN/AVideo/commit/e6566f56a28f4556b2a0a09d03717a719dcb49da",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-qm9p-p5pw-jrx2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-qm9p-p5pw-jrx2",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}