CVE-2026-81732 WWBN CVE debrief

Who should care

AVideo administrators, security teams, and users who require protection against unauthenticated access to user registration statistics should be aware of this vulnerability. They should verify their AVideo versions, restrict access to the affected endpoints, and monitor for suspicious requests. Additionally, security teams should review their vulnerability management processes to ensure they can detect and respond to similar issues in the future.

Technical summary

The CVE-2026-81732 vulnerability in AVideo through version 30.0 allows unauthenticated access to user registration statistics via report4.json.php and report4.1.json.php endpoints. Attackers can send GET requests to these endpoints to retrieve daily and cumulative user-registration counts without any session or authorization. This vulnerability has a CVSS score of 6.9 and is classified as MEDIUM severity.

Defensive priority

Medium-priority vulnerability in AVideo, allowing unauthenticated access to user registration statistics.

Recommended defensive actions

• Verify AVideo version and apply patches if available
• Restrict access to report4.json.php and report4.1.json.php endpoints
• Monitor for suspicious requests to these endpoints
• Consider implementing additional authentication mechanisms
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE-2026-81732 vulnerability in AVideo through version 30.0 allows unauthenticated access to user registration statistics via report4.json.php and report4.1.json.php endpoints. Evidence is based on official CVE and NVD records, as well as advisories from Vulncheck and GitHub. To verify, defenders should check for affected versions, review access controls, and monitor for suspicious requests.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.