CVE-2026-43873

The record

WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/CloneSite/cloneClient.json.php echoes the local CloneSite shared secret ($objClone->myKey, a constant md5($global['systemRootPath'] . $global['salt'])) into the HTTP response body on every unauthenticated request. The unauthenticated error branch was intended to reject non-admin callers without a valid key, but the rejection message interpolates the expected key before die(). When the victim has CloneSite configured with a remote cloneSiteURL (standard federation/backup setup), the leaked myKey is exactly the credential that authenticates the victim to that remote server's cloneServer.json.php, allowing the attacker to impersonate the victim and trigger a full mysqldump of the remote's database to the remote's public videos/clones/ directory Commit e6566f56a28f4556b2a0a09d03717a719dcb49da contains an updated fix.

Affected packages

Related vulnerabilities

• CVE-2026-92936 vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code… CWE-209
• CVE-2026-11873 An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests)… CWE-209
• CVE-2026-82739 Generation of Error Message Containing Sensitive Information vulnerability in ash-project… CWE-209
• CVE-2026-82733 Generation of Error Message Containing Sensitive Information vulnerability in ash-project… CWE-209
• CVE-2026-77950 Generation of Error Message Containing Sensitive Information vulnerability in ash-project… CWE-209
• CVE-2026-82727 Generation of Error Message Containing Sensitive Information vulnerability in ash-project… CWE-209
• CVE-2026-82580 Generation of Error Message Containing Sensitive Information vulnerability in ash-project… CWE-209
• CVE-2026-75760 Generation of Error Message Containing Sensitive Information vulnerability in ash-project… CWE-209