WWBN AVideo CVE-2026-40907

Exploitation requires an authenticated account on the target AVideo instance with streaming permission - the canStream() check must pass, meaning the attacker's account must have been granted streaming rights by an administrator. The Live plugin must be installed and active on the deployment. The attacker must know or enumerate victim user IDs, which are sequential integers in the database and practically guessable. No admin privileges are required - any streaming-enabled peer on the same instance can exploit this against any other user. Limiting factors: unauthenticated users cannot exploit this (CVSS PR:L); the attack is scoped to users of the same AVideo deployment; exploitation is not automatable at scale per SSVC (no known mass-targeting tooling exists); only users who have configured live restream integrations with third-party platforms have exploitable data stored.

CVSS 6.5 Medium with AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N accurately captures a network-accessible, low-complexity information disclosure requiring only a low-privileged streaming account - consistent with the actual exploitation mechanics. The confidentiality impact is genuinely High because exposed OAuth refresh tokens represent persistent third-party account access (YouTube, Facebook, Twitch), not merely internal session leakage. SSVC classifies exploitation as poc, automatable as no, and technical impact as partial - indicating the attack requires manual targeting of specific user IDs rather than mass automated exploitation. EPSS at 0.03% (8th percentile) corroborates low broad exploitation probability. The absence of a KEV listing means active exploitation is not confirmed. Real-world risk is elevated specifically for competitive or adversarial multi-tenant AVideo deployments where users might target one another, but minimal for single-operator or tightly controlled instances. No conflicting signals between data sources - all indicators align consistently.

An attacker registers or obtains a streaming-permission account on a target AVideo instance, then iterates integer user IDs by sending authenticated GET requests to /plugin/Live/view/Live_restreams/list.json.php?users_id=<target_id> with their session cookie. Each successful response returns the victim's RTMP stream key and OAuth credential blob for connected social platforms, which the attacker can use to hijack livestreams or gain persistent access to the victim's YouTube or Facebook account. A proof-of-concept demonstrating this curl-based technique is included in the GHSA advisory.