What is the CVSS score of CVE-2026-40907?

CVE-2026-40907 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

WWBN AVideo CVE-2026-40907

EUVD-2026-24284 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-21 GitHub_M

Authentication Bypass PHP Avideo

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network endpoint requires streaming-level credentials (PR:L); read-only IDOR yields high confidentiality impact via OAuth tokens with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:07 vuln.today

Analysis Generated

Jul 24, 2026 - 07:07 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 20:00 euvd

EUVD-2026-24284

CVE Published

Apr 21, 2026 - 19:50 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 29.0 and prior, the endpoint plugin/Live/view/Live_restreams/list.json.php contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user with streaming permission to retrieve other users' live restream configurations, including third-party platform stream keys and OAuth tokens (access_token, refresh_token) for services like YouTube Live, Facebook Live, and Twitch. Commit d5992fff2811df4adad1d9fc7d0a5837b882aed7 fixes the issue.

AnalysisAI

Insecure Direct Object Reference in AVideo's live restream list endpoint exposes any victim user's RTMP stream keys and OAuth tokens - including access_token and refresh_token for YouTube Live, Facebook Live, and Twitch - to any peer with a streaming-permission account on the same instance. The flaw exists in versions 29.0 and prior, where the authorization guard in list.json.php is trivially bypassed by supplying an explicit users_id GET parameter, routing directly to an attacker-controlled database query. Publicly available exploit code exists per SSVC; EPSS is 0.03% (8th percentile), indicating limited opportunistic exploitation at this time, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

AVideo is a PHP-based open-source video platform (CPE: cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*) distributed as a Composer package (wwbn/avideo). The root cause is CWE-639 (Authorization Through User-Controlled Key): the Live plugin's list.json.php uses the user-supplied users_id GET parameter as the authorization scope key without validating that the requesting user owns the referenced records. The flawed implementation used an empty() guard that only enforced self-scoping when the parameter was absent - a non-admin user who explicitly provides users_id skips the override entirely and routes the attacker-controlled value directly to Live_restreams::getAllFromUser(), which executes SELECT * FROM live_restreams WHERE users_id = $users_id, returning all columns including stream_key (VARCHAR 500), stream_url (VARCHAR 500), and a parameters TEXT blob containing OAuth credentials from the restream.ypt.me flow. Other endpoints in the same directory (e.g., delete.json.php) perform correct ownership validation, confirming this was an isolated omission rather than a systemic design failure.

RemediationAI

Apply the upstream fix from commit d5992fff2811df4adad1d9fc7d0a5837b882aed7 (https://github.com/WWBN/AVideo/commit/d5992fff2811df4adad1d9fc7d0a5837b882aed7), which removes the flawed empty() guard and unconditionally forces non-admin users to their own ID in list.json.php regardless of the GET parameter supplied. Note that a tagged patched release version is not confirmed in available data - the Composer package fix version is listed as None - so administrators must verify whether a release incorporating this commit has been published before relying on package-manager updates alone. As a compensating control pending patching, restrict HTTP access to plugin/Live/view/Live_restreams/list.json.php at the web server layer (nginx location block or Apache deny rule) to admin sessions only; this disables the restream list UI for non-admin streamers as a trade-off. Regardless of patch status, operators on multi-tenant deployments should immediately rotate all third-party stream keys and revoke OAuth tokens (YouTube, Facebook, Twitch) connected to AVideo restream configurations, as any streaming-permission user may have already accessed them.