WWBN AVideo CVE-2026-86726

Exploitation requires a valid AVideo user account with streaming capability (CVSS PR:L); anonymous access to the endpoint is not possible. The vulnerability exists in the default behavior of restreamsActive.json.php in AVideo ≤29.0 - no non-default server configuration is needed. The practical impact is bounded to multi-user deployments where at least one other streamer has an active restream session at the time of the request; single-operator instances with no external user accounts are not materially at risk. There is no platform, OS, or deployment-mode restriction beyond the PHP-based AVideo application itself.

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) accurately captures the primary risk signal: high confidentiality impact on credentials that unlock third-party accounts. The low attack complexity and absence of any special attack requirements mean that even a mid-sized deployment shared across many streamers - as might be operated by a community broadcaster or a municipal media team in zabrze - faces meaningful insider-threat risk from any participant with a streaming account. However, the PR:L requirement (authenticated streamer account) is a genuine limiting factor that prevents anonymous mass exploitation. Real-world impact is most severe on multi-tenant or shared AVideo deployments; single-operator instances with no external user accounts are not exposed. No CISA KEV listing exists, no public exploit code has been identified, and EPSS data was not provided, collectively suggesting this vulnerability is not under active or widespread exploitation. The combination of a straightforward attack path and high-value credential exposure makes this a meaningful priority for shared AVideo operators despite the absence of observed exploitation.

An attacker holding a basic streaming account on a shared AVideo instance sends a single authenticated GET request to /json/restreamsActive.json.php and receives a JSON payload containing stream keys and identity information for every currently active streamer on the platform. The attacker extracts stream keys for high-profile accounts and uses them to connect to the corresponding third-party streaming endpoints (e.g., Twitch RTMP ingest), effectively hijacking those broadcasts or terminating them by competing for the same key slot. No public exploit code is required - the attack is trivially reproducible with any HTTP client.