WWBN AVideo CVE-2026-91965

Requires that the target AVideo instance has the Live plugin installed and its stats.json.php / calendar.json.php endpoints reachable over HTTP(S) - i.e., the deployment mode where live streaming is enabled, which is the default for sites using that plugin. At least one live transmission (or scheduled event, for the calendar endpoint) and, ideally for the attacker, one that is scoped to a restricted user group must exist for the leak to be meaningful; the group restriction itself is precisely what the endpoint fails to enforce. Per the CVSS 4.0 vector (PR:N, UI:N), no authentication, session, or user interaction is required, and no special headers or non-default configuration flags are needed. Limiting factors: the endpoints are path-specific, so a site that has removed or disabled the Live plugin is not affected; the leak is read-only (VI:N/VA:N), so it does not by itself alter the platform, and the direct-URL HLS access may be constrained if the site additionally protects the HLS layer with tokens or CDN signing.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) describes a network-reachable, low-complexity, unauthenticated disclosure of high-value confidential data with no user interaction and no attack requirements - a purely automatable reconnaissance-class attack. The impact is confined to confidentiality (no integrity or availability impact, no scope change), which is consistent with the metadata/HLS-URL leak described; the 8.7 score is driven by VC:H. There is no CISA KEV listing and no confirmed public PoC in the supplied data, so this is not currently a confirmed active-exploitation emergency, but EPSS-style mass scanning potential is high because the endpoints are unauthenticated GET requests that can be enumerated across the internet. The key caveat: absent KEV or PoC confirmation, treat this as a high-priority exposure-reduction item rather than an incident response trigger. No EPSS score was supplied - exploitation likelihood is inferred from the CVSS vector, not measured.

An attacker enumerates AVideo hosts (fingerprinted by the platform's login page or the plugin/Live path), then issues two unauthenticated GET requests to /plugin/Live/stats.json.php and /plugin/Live/calendar.json.php. The JSON responses return stream keys, titles, descriptions, owner identities, and direct HLS playback URLs for live transmissions that were meant to be restricted to a specific user group. The attacker then either publishes to the victim's RTMP ingest using the leaked stream key (hijacking the channel) or simply watches/re-broadcasts the private feed via the HLS URL.