WWBN AVideo CVE-2026-86728

No special conditions - remote unauthenticated exploitation against default configurations of WWBN AVideo through 29.0. The vulnerable PHP endpoint is present in all installations that include the PlayLists plugin (bundled by default). The only limiting factor is network reachability: instances behind a firewall or VPN that restricts public HTTP access are not directly exploitable from the internet, but any instance with a publicly routed web interface is exposed without further prerequisites. No authentication token, session cookie, API key, or specific HTTP header is required.

The CVSS 4.0 score of 8.7 with a fully unauthenticated, low-complexity network vector accurately reflects the ease of exploitation - even a mid-sized municipal IT team in kielce operating a community streaming service should treat this as urgent given that live-stream ingest keys, once disclosed, allow a third party to hijack broadcast sessions or inject content. The VC:H rating is justified: live-stream keys and server identifiers constitute high-value credentials whose compromise can cascade to full broadcast takeover. No KEV listing exists and no public exploit code has been confirmed, so opportunistic mass scanning is not yet observed, but the endpoint requires no authentication and no special tooling - a simple HTTP GET with an iterated ID parameter is sufficient. EPSS data is not available in the current input, but the trivial exploitation path suggests the score would climb quickly once public attention is drawn to the GHSA advisory. The absence of an integrity or availability impact in the CVSS vector is appropriate: the endpoint is read-only, but downstream misuse of disclosed stream keys could enable unauthorized re-streaming or content injection through separate mechanisms.

An attacker sends a series of unauthenticated HTTP GET requests to https://[avideo-host]/plugin/PlayLists/epg.json.php?id=1, incrementing the ID parameter from 1 upward. For each valid user or playlist ID, the server responds with live-stream ingest keys, RTMP server identifiers, and complete EPG schedules. The attacker harvests these keys and uses them to connect directly to the streaming ingest endpoint, enabling unauthorized re-broadcasting or content replacement. No exploit code is required beyond a basic HTTP client or curl loop.