CVE-2026-35179CWE-862

WWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php

Medium · published April 6, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
23.0
In the wild
Unconfirmed
What it is

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the SocialMediaPublisher plugin exposes a publishInstagram.json.php endpoint that acts as an unauthenticated proxy to the Facebook/Instagram Graph API. The endpoint accepts user-controlled parameters including an access token, container ID, and Instagram account ID, and passes them directly to the Graph API via InstagramUploader::publishMediaIfIsReady(). This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform's own credentials.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00313 · 23.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-04-06T19:05Z
EPSS history
Timeline
  • 06 APR 19:05Z
    WWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php
    cvelistv5