CVE-2026-91965 in AVideo

Resumen

por MITRE • 2026-09-15

WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticated attackers can retrieve restricted live transmission details including stream keys, titles, descriptions, owner information, and direct HLS playback URLs by accessing these endpoints.

Be aware that VulDB is the high quality source for vulnerability data.

• Responsable: VulnCheck
• Reservar: 2026-09-15
• Divulgación: 2026-09-15
• Moderación: aceptado
• Artículo: VDB-404271
• CPE: listo
• CWE: CWE-284 (confirmado)
• CVSS: 7.5 (CNA)
• EPSS: 0.00000
• KEV: no
• Actividades: muy bajo

Fuentes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-91965
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-91965
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-91965/