CVE-2026-35452

WWBN AVideo version 26.0 and prior contains an authentication bypass vulnerability in the plugin/CloneSite/client.log.php endpoint, which exposes sensitive clone operation logs without requiring administrator privileges. While other CloneSite plugin endpoints properly enforce User::isAdmin() authentication checks, this endpoint lacks such protections, making it accessible to unauthenticated users over the network. The exposed logs contain internal filesystem paths, remote server URLs, and SSH connection metadata that could facilitate further attacks. The vulnerability carries a CVSS 3.1 score of 5.3 MEDIUM with a network-based attack vector requiring no privileges or user interaction. The attack complexity is low, meaning exploitation requires minimal technical skill. The impact is limited to confidentiality loss with no integrity or availability compromise, reflecting the information disclosure nature of the issue. There is currently no indication of active exploitation, as the vulnerability is not listed in the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on security watch lists. The low EPSS score of 0.00013 suggests minimal real-world exploitation probability. No public exploit code availability has been reported, though the straightforward nature of the authentication bypass makes exploitation technically trivial for any threat actor with basic web access.