WWBN AVideo CVE-2026-89250

The AVideo instance must be reachable over the network (typical for any internet-facing or LAN-deployed AVideo server). The attacker must supply a stream key corresponding to an existing recorded FLV file in the temporary directory - obtainable by observing stream URLs during legitimate sessions, leakage through other unauthenticated endpoints, or enumeration if keys are predictable. No authentication, session token, or user account is required to invoke the vulnerability. Exploitation is limited to reading recorded FLV video files from the temporary recording directory; it does not provide write access, code execution, or access to files outside that directory. The vulnerability does not require any special server configuration beyond a default AVideo deployment that has recorded at least one live stream.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) and score of 8.7 accurately capture the network-exposed, zero-authentication nature of the flaw, with high confidentiality impact limited to the vulnerable system and no integrity or availability dimension. The primary friction is stream key knowledge - if keys are randomly generated UUIDs, practical exploitability is lower than the AC:L rating implies; if keys are sequential, short, or derived from predictable metadata (timestamp, username), enumeration becomes trivial. EPSS data is absent from the available intelligence, and the vulnerability is not listed in CISA KEV, suggesting no confirmed mass exploitation at time of analysis; even a mid-sized municipal IT team in gniezno should treat this as urgent patching work rather than an emergency incident response, given the data-exposure rather than full-compromise impact. No public exploit or POC is identified. Overall, real-world priority depends heavily on stream key predictability and whether the AVideo instance hosts sensitive or regulated content.

An attacker discovers a publicly accessible AVideo instance, then queries getRecordedFile.php with stream keys obtained from a prior unauthenticated API call, leaked URL, or brute-forced short key space. The endpoint returns the raw FLV recording without any session check, allowing the attacker to download private live-stream recordings. No public POC is confirmed, but the endpoint mechanism requires no special tooling beyond a standard HTTP client.