WWBN AVideo CVE-2026-88865

Attacker must hold a valid AVideo account with the canStream permission - a non-default, explicitly granted capability for streaming users. The target user must have configured at least one restream destination (YouTube, Twitch, or RTMP) with a stored stream key. No other special configuration is required beyond normal AVideo deployment with restreaming enabled. Exploitation is limited to authenticated canStream users; anonymous access or basic authenticated accounts without canStream cannot reach the vulnerable endpoints. The absence of ownership validation means no predictability of victim IDs is strictly necessary if the attacker can enumerate IDs through normal platform activity.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N) accurately reflects network-accessible, low-complexity exploitation requiring only a canStream-level account. The SC/SI metrics are scored N in the provided vector, but this may understate real-world impact: the exposed stream keys authenticate directly to YouTube/Twitch/RTMP endpoints - external systems - meaning subsequent-system confidentiality and integrity are also materially compromised. EPSS data is not provided; no KEV listing or confirmed active exploitation is noted. With no public POC and a relatively niche self-hosted platform, broad opportunistic exploitation is unlikely; however, within multi-tenant AVideo deployments (hosting companies, media organizations), a malicious canStream tenant could systematically harvest all other users' streaming credentials with minimal effort and no special tooling.

An attacker with a low-privilege AVideo account that has canStream permission enumerates or guesses restream IDs belonging to other users, then sends crafted requests to getRestream.json.php specifying those IDs. The server returns valid tokens without checking ownership. The attacker exchanges each token against getLiveKey.json.php to extract stream keys, then uses those keys to go live on victims' YouTube or Twitch channels - potentially posting unauthorized content, disrupting legitimate broadcasts, or selling access to compromised streaming accounts.