CVE-2026-35179 — Missing Authorization in Avideo
Severity
5.3MEDIUMNVD
EPSS
0.1%
top 84.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
Latest updateApr 3
PublishedApr 6
Description
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the SocialMediaPublisher plugin exposes a publishInstagram.json.php endpoint that acts as an unauthenticated proxy to the Facebook/Instagram Graph API. The endpoint accepts user-controlled parameters including an access token, container ID, and Instagram account ID, and passes them directly to the Graph API via InstagramUploader::publishMediaIfIsReady(). This allows any unauthenticated user to make arbitrary Graph API call…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4