CVE-2026-40908 - Vulnerability Analysis

Overview

WWBN AVideo <= 29.0 contains an information disclosure caused by execution of 'git log -1' in git.json.php, letting unauthenticated attackers access commit hashes, developer PII, and commit messages, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can access sensitive commit data including PII and internal references, aiding further targeted attacks.

Mitigation

Update to the latest version once a patch is available.

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-52hf-63q4-r926

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner