WWBN AVideo CVE-2026-86727

The Live streaming plugin must be installed and active - this is an optional component, not part of the AVideo core. The vulnerable endpoint plugin/Live/stats.json.php must be reachable over the network; default AVideo deployments expose all plugin endpoints publicly unless the operator has applied explicit access controls at the web server layer. No authentication, no special headers, no prior session state, and no user interaction are required: a single unauthenticated GET request to the endpoint is sufficient. Exploitation is limited to instances running AVideo ≤29.0 with the Live plugin enabled; instances without live streaming functionality are not affected.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) is well-calibrated: the attack is fully unauthenticated, requires no special conditions, and yields high confidentiality impact via stream key exposure. Because stream keys are effectively bearer credentials, their disclosure can lead to secondary impacts including stream hijacking and content theft that go beyond pure information disclosure. EPSS data is not provided in the input, and CISA KEV status is absent, so there is no confirmed active exploitation signal. The vulnerability is trivially automatable - a single unauthenticated HTTP GET request suffices - which raises the realistic exploitation probability significantly above what EPSS would typically assign to a newly disclosed information-disclosure issue. The primary limiting factor is that AVideo is self-hosted niche software rather than ubiquitous infrastructure, reducing the breadth of exposed targets. For any operator running an AVideo instance with private or monetized live streams, this is a genuine high-priority issue due to stream key reuse risk.

An attacker discovers a publicly reachable AVideo instance with live streaming enabled and sends a single unauthenticated HTTP GET request to https://target.example.com/plugin/Live/stats.json.php. The JSON response includes the hidden_applications array containing stream keys for the host's private and group-restricted channels; the attacker parses and extracts these keys and uses them to authenticate an RTMP publishing session, hijacking or mirroring a private live broadcast.