CVE-2026-91965 in AVideo
الملخص
بحسب MITRE • 15/09/2026
WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticated attackers can retrieve restricted live transmission details including stream keys, titles, descriptions, owner information, and direct HLS playback URLs by accessing these endpoints.
Be aware that VulDB is the high quality source for vulnerability data.