VulnSocial

CVE-2026-35179Disclosure(wwbn / avideo)

LOWCVSS 5.3 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the SocialMediaPublisher plugin exposes a publishInstagram.json.php endpoint that acts as an unauthenticated proxy to the Facebook/Instagram Graph API. The endpoint accepts user-controlled parameters including an access token, container ID, and Instagram account ID, and passes them directly to the Graph API via InstagramUploader::publishMediaIfIsReady(). This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform's own credentials.

wwbn CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Exploit / PoC references
Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • avideo

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
wwbn
Products
avideo

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-04-06: 204-06
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    General

    🚨*CVE* CVE-2026-35179 WWBN AVideo is an open source video platform. In versions 26.0 and prior, the SocialMediaPublisher plugin exposes a publishInstagram.json.php endpoint that acts as an… https://www.cve.org/CVERecord?id=CVE-2026-35179 ----- Traducción: CVE-2026-35179 WWB… http://infoflow.cloud`

    Post summary

    The post signals a CVE in the SocialMediaPublisher plugin of WWBN AVideo but provides no actionable or detailed information.

    0000030
    67 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-35179 WWBN AVideo is an open source video platform. In versions 26.0 and prior, the SocialMediaPublisher plugin exposes a publishInstagram.json.php endpoint that acts as an… https://www.cve.org/CVERecord?id=CVE-2026-35179

    Post summary

    The text highlights a CVE (CVE-2026-35179) affecting the SocialMediaPublisher plugin of the WWBN AVideo platform, noting that a specific endpoint is exposed in versions 26.0 and earlier.

    00000160
    57.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appwwbnavideo---

Explore more

Back to dashboardwwbn CVEsavideo vulnerabilities