CVE-2026-43873 WWBN AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server

🗓️ 11 May 2026 20:31:06Reported by GitHub_MType

vulnrichment🔗 github.com👁 12 Views

Unauthenticated error echoes CloneSite myKey, enabling cross-site database dump to remote cloneServer.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2026-43873	25 Apr 202600:46	–	circl
CNNVD	WWBN AVideo 安全漏洞	11 May 202600:00	–	cnnvd
CVE	CVE-2026-43873	11 May 202620:31	–	cve
Cvelist	CVE-2026-43873 WWBN AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server	11 May 202620:31	–	cvelist
Github Security Blog	AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server	5 May 202618:58	–	github
NVD	CVE-2026-43873	11 May 202622:22	–	nvd
OSV	GHSA-QM9P-P5PW-JRX2 AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server	5 May 202618:58	–	osv
Positive Technologies	PT-2026-37289	5 May 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-43873: Generation of Error Message Containing Sensitive Information	11 May 202600:00	–	rapid7
RedhatCVE	CVE-2026-43873	5 Jun 202619:23	–	redhatcve

Source	Link
github	www.github.com/WWBN/AVideo/security/advisories/GHSA-qm9p-p5pw-jrx2
github	www.github.com/WWBN/AVideo/commit/e6566f56a28f4556b2a0a09d03717a719dcb49da

11 May 2026 20:31Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

EPSS0.00255

SSVC

CloneSite myKey Unauthenticated error Cross site dump Remote clone server Database dump