https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-14T23:59:57.853929+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-276712 EUVD-2026-276712 2026-10-14T23:59:57.914839+00:00 EUVD-2026-276712 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33038 fkie_cve-2026-33038 2026-10-14T23:59:57.914891+00:00

WWBN AVideo is an open source video platform. Versions 25.0 and below are vulnerable to unauthenticated application takeover through the install/checkConfiguration.php endpoint. install/checkConfiguration.php performs full application initialization: database setup, admin account creation, and configuration file write, all from an unauthenticated POST input. The only guard is checking whether videos/configuration.php already exists. On uninitialized deployments, any remote attacker can complete the installation with attacker-controlled credentials and an attacker-controlled database, gaining full administrative access. This issue has been fixed in version 26.0.

 https://cve.radiocsirt.org/vuln/ghsa-2f9h-23f7-8gcx GHSA-2f9h-23f7-8gcx — AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments 2026-10-14T23:59:57.914951+00:00

Affected: Packagist: wwbn/avideo

## Summary The `install/checkConfiguration.php` endpoint performs full application initialization — database setup, admin account creation, and configuration file write — from unauthenticated POST input. The only guard is checking whether `videos/configuration.php` already exists. On uninitialized deployments, any remote attacker can complete the installation with attacker-controlled credentials and an attacker-controlled database, gaining full administrative access.

## Affected Component - `install/checkConfiguration.php` — entire file (lines 1-273)

## Description

### No authentication or access restriction on installer endpoint

The `checkConfiguration.php` file performs the most privileged operations in the application — creating the database schema, the admin account, and the configuration file — with no authentication, no setup token, no CSRF protection, and no IP restriction. The sole guard is a file-existence check:

```php // install/checkConfiguration.php — lines 2-5 if (file_exists("../videos/configuration.php")) { error_log("Can not create configuration again: ". json_encode($_SERVER)); exit; } ```

If `videos/configuration.php` does not exist (fresh deployment, container restart without persistent storage, re-deployment), the entire installer runs with attacker-controlled POST parameters.

### Attacker-controlled database host eliminates credential guessing

Unlike typical installer exposure vulnerabilities where the attacker must guess the target's d…