WWBN AVideo CVE-2026-88874

The Live plugin must be installed and active in AVideo, and at least one live stream must be configured with password protection enabled (isPasswordProtected flag set). The NGINX configuration deployed must match the shipped deploy/nginx/nginx.conf template, in which the auth_key_check directive in the .key location is commented out. No authentication, special network position, or prior account is required by the attacker. Exploitation is limited to scenarios where the Live plugin is in active use - AVideo instances that do not use live streaming are not exposed to the HLS key-disclosure component, though the PHP stats API disclosure may still leak stream metadata. The attack does not affect recorded/VOD content, only live HLS transmissions.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N scores 8.7 and accurately reflects the attack profile: no authentication, no complexity, fully network-accessible. EPSS data is not included in the provided intelligence but the attack is trivial - a single HTTP request to the stats endpoint suffices to obtain the stream key and m3u8 URL, followed by a second request for the AES-128 key. Real-world risk is high wherever the Live plugin is actively used for paid or restricted streams; even a mid-sized municipal IT team in swidnica running an AVideo instance for internal training sessions would have protected stream content exposed. The absence of a patch amplifies urgency: as of the advisory date (2026-08-23) all AVideo deployments at or before commit c3edcc274 are vulnerable with no vendor-provided fix. No public POC code was referenced but the exploit path requires only standard HTTP tooling against two well-documented endpoints. KEV status is not confirmed. The confidentiality impact is total for live-stream content - stream keys, HLS playlists, and AES decryption material are all disclosed - though integrity and availability are unaffected.

An attacker targeting a paid AVideo live stream sends an unauthenticated HTTP GET to the platform's stats API endpoint, receiving a JSON response that includes the RTMP stream key and the HLS m3u8 URL for the password-protected transmission. The attacker then fetches the AES-128 decryption key directly from the NGINX-served /live/.key path - also without authentication - and uses standard HLS tooling (e.g., ffmpeg or VLC) to decrypt and play the transport-stream segments, fully bypassing the configured stream password with no special tooling beyond a browser or command-line HTTP client. No public POC exploit code was referenced in the provided intelligence.