Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-61571— AVideo-Encoder: missing authentication on control and status endpoints

Quick assessment

Affected
WWBN AVideo-Encoder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AVideo 是一个视频分享平台。在 8.1.0 版本之前，其编码器（encoder）缺少全局认证层，导致控制与状态相关的 PHP 端点暴露给匿名网络调用者。具体问题如下： 中的安全守卫（guard）被注释掉，直接调用了 。 调用 ，通过 泄露推流器（streamer）的 URL，并触发 启动处理任务。 返回带有通配符的 响应头，读取任务队列、触发处理流程，并在 参数被设置时，通过 暴露主机内存统计信息。 仅检查 ，而该方法在 配置为空（默认值）时会允许匿名调用。其 参数通过 解析后，使用 列出文件，且未限制基础目

CVSS 7.3 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61571

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AVideo-Encoder: missing authentication on control and status endpoints
Source: CVE Program / CVE List V5
Vulnerability Description
AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. `view/run.php` has a commented-out guard and invokes `Encoder::run()`. `view/queue.json.php` calls `Encoder::getAll(true)`, reveals streamer URLs through `getSiteURL()`, and triggers processing with `execRun()`. `view/status.php` returns `Access-Control-Allow-Origin` with a wildcard, reads the queue, triggers processing, and exposes host memory statistics through `ServerMonitor::getMemory()` when `serverStatus` is set. `view/listFiles.json.php` checks only `Login::canBulkEncode()`, which admits anonymous callers whenever `disableBulkEncode` is empty, the default. Its `path` parameter is resolved with `realpath()` and listed with `scandir()` without a base-directory restriction. An unauthenticated attacker can drive the privileged queue processor, read queue and streamer-site information, obtain memory statistics and enumerate media file names and paths in any directory readable by the web-server user. Enumeration is limited to configured media extensions and does not itself disclose arbitrary file contents. This issue is fixed in version 8.1.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
WWBN AVideo-Encoder < 8.1.0 -

II. Public POCs for CVE-2026-61571

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61571

请登录查看更多情报信息。

Other References for CVE-2026-61571 (3)

Same Patch Batch · WWBN · 2026-10-28 · 7 CVEs total

CVE-2026-61567 10.0 CRITICAL AVideo-Encoder: unauthenticated command execution through streamer login trust
CVE-2026-61564 10.0 CRITICAL AVideo-Encoder: unauthenticated installer PHP code injection
CVE-2026-61572 8.6 HIGH AVideo-Encoder: unauthenticated full-response server-side request forgery
CVE-2026-61569 7.5 HIGH AVideo-Encoder: pre-authentication streamer-login SQL injection
CVE-2026-61573 6.1 MEDIUM AVideo-Encoder: reflected cross-site scripting in the login interface
CVE-2026-61575 4.7 MEDIUM AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles

IV. Related Vulnerabilities

Same product: AVideo-Encoder
Same vendor: WWBN
Same weakness: CWE-306