AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. view/run.php has a commented-out guard and invokes Encoder::run(). view/queue.json.php calls Encoder::getAll(true), reveals streamer URLs through getSiteURL(), and triggers processing with execRun(). view/status.php returns Access-Control-Allow-Origin with a wildcard, reads the queue, triggers processing, and exposes host memory statistics through ServerMonitor::getMemory() when serverStatus is set. view/listFiles.json.php checks only Login::canBulkEncode(), which admits anonymous callers whenever disableBulkEncode is empty, the default. Its path parameter is resolved with realpath() and listed with scandir() without…