GHSA-xr49-f4rh-qcjf AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization

• Packagist wwbn/avideo: <= 29.0 (no fix yet)

Summary An unauthenticated user can read `APISecret` from `objects/plugins.json.php` and use it to call protected API endpoints (e.g. `users_list`) without logging in. ### Details `objects/plugins.json.php` is public and still exposes plugin `object_data` containing `APISecret`. That secret is accepted by `plugin/API/get.json.php` as authentication. ### PoC 1. Get plugin config (contains `APISecret`): ```bash curl 'http:///objects/plugins.json.php' ``` 2. Copy APISecret from response, then call API directly: ```bash curl --get 'http:///plugin/API/get.json.php' \ --data-urlencode 'APIName=users_list' \ --data-urlencode 'APISecret=' \ --data-urlencode 'rowCount=3' \ --data-urlencode 'current=1' ``` ### Impact Unauthenticated disclosure of sensitive config (APISecret) leading to unauthorized access to protected API data. ### Recommended fix Requiring admin auth for full plugin inventory/config endpoint.