CVE-2026-91965 in AVideo
Summary
by MITRE • 09/15/2026
WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticated attackers can retrieve restricted live transmission details including stream keys, titles, descriptions, owner information, and direct HLS playback URLs by accessing these endpoints.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in WWBN AVideo versions up to 29.0 represents a critical failure in access control mechanisms within the application's plugin architecture. Specifically, the endpoints located at plugin/Live/stats.json.php and plugin/Live/calendar.json.php are designed to provide statistical data regarding live streaming sessions. However, these endpoints do not properly enforce user-group restrictions or authentication requirements before returning sensitive information. This misconfiguration allows unauthenticated actors to interact with internal application logic that should be restricted to authorized administrators or specific user groups, effectively bypassing the intended security boundaries of the platform.
From a technical perspective, this flaw constitutes an insecure direct object reference combined with broken access control. The server processes requests for live transmission details without verifying whether the requesting entity possesses the necessary privileges to view such data. Consequently, any individual on the network can send HTTP GET or POST requests to these specific JSON endpoints and receive structured responses containing detailed metadata about active streams. This includes highly sensitive operational data such as stream keys, which are essentially passwords used by broadcasting software to connect to the streaming server; titles and descriptions of the content being broadcasted; owner information that may reveal personal details of the channel administrators; and direct HLS playback URLs that allow for immediate consumption or redistribution of the live video feed.
The operational impact of this vulnerability is severe, particularly in environments where AVideo is used for professional broadcasting, educational institutions, or corporate communications. The exposure of stream keys poses a significant risk as it enables attackers to hijack active streams by injecting their own malicious content into the broadcast channel using the stolen credentials. This can lead to defacement, dissemination of illegal or harmful material under the victim's identity, and severe reputational damage for the organization hosting the service. Furthermore, the disclosure of owner information and direct playback URLs facilitates targeted phishing attacks and unauthorized surveillance of private events that were intended to be restricted to specific audiences. The ability to retrieve this data without authentication means the attack surface is wide open to automated scanning tools and opportunistic attackers alike.
In terms of industry classification standards, this vulnerability aligns with CWE-284 Improper Access Control, as the application fails to restrict access to resources based on user roles or privileges. It also relates to CWE-798 Use of Hard-coded Credentials if stream keys are considered static secrets exposed via API endpoints, and potentially CWE-613 Insufficient Session Expiration if session tokens were involved but not validated correctly. From a tactical perspective within the MITRE ATT&CK framework, this behavior supports reconnaissance activities categorized under T1072 Software Discovery or T1589 Gather Victim Identity Information, as it allows an attacker to map out active services and identify valuable targets for further exploitation such as stream hijacking (T1499 Endpoint Denial of Service via content injection) or credential theft.
To mitigate this vulnerability, immediate action is required to patch the AVideo installation to a version newer than 29.0 where these access control issues have been addressed by the vendor. In cases where upgrading is not immediately feasible, administrators should implement network-level controls such as firewall rules or reverse proxy configurations to restrict access to the plugin/Live/ directory exclusively from trusted internal IP addresses or specific administrative subnets. Additionally, enabling strict authentication requirements for all JSON API endpoints and ensuring that session tokens are validated against user permissions before processing requests can provide a compensating control layer. Regular security audits of custom plugins and third-party modules within the AVideo ecosystem are also recommended to identify similar access control flaws in other parts of the application infrastructure.