CVE-2026-84481

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 30.0

Description An information disclosure issue exists in the MobileManager plugin. An unauthenticated visitor can send a GET request to the 'plugin/MobileManager/getConfiguration.json.php' endpoint to retrieve sensitive configuration data. The exposed information includes TLS private key file paths, socket configuration details, platform version, and debug flags, which could facilitate further targeted attacks.

Recommendations Update AVideo to a version later than 30.0. Restrict access to the 'plugin/MobileManager/getConfiguration.json.php' endpoint to prevent unauthenticated access.