CVE-2026-35179

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the SocialMediaPublisher plugin exposes a publishInstagram.json.php endpoint that acts as an unauthenticated proxy to the Facebook/Instagram Graph API. The endpoint accepts user-controlled parameters including an access token, container ID, and Instagram account ID, and passes them directly to the Graph API via InstagramUploader::publishMediaIfIsReady(). This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform's own credentials.

The following products are affected by CVE-2026-35179 vulnerability.

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-35179.

URL	Resource
https://github.com/WWBN/AVideo/security/advisories/GHSA-x9w5-xccw-5h9w