CVE-2026-126541

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows authenticated streamers to obtain other users' stream keys by supplying arbitrary livetransmitionshistoryid values. Attackers can redeem the issued action tokens at...

CVE-2026-126541

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows authenticated streamers to obtain other users' stream keys by supplying arbitrary livetransmitionshistoryid values. Attackers can redeem the issued action tokens at...

EUVD-2026-123066

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows authenticated streamers to obtain other users' stream keys by supplying arbitrary livetransmitionshistoryid values. Attackers can redeem the issued action tokens at...

CVE-2026-126541 WWBN AVideo through 29.7.1 Missing Authorization via Live Restream Endpoints

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows authenticated streamers to obtain other users' stream keys by supplying arbitrary livetransmitionshistoryid values. Attackers can redeem the issued action tokens at...

CVE-2026-126541 WWBN AVideo through 29.7.1 Missing Authorization via Live Restream Endpoints

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows authenticated streamers to obtain other users' stream keys by supplying arbitrary livetransmitionshistoryid values. Attackers can redeem the issued action tokens at...

CVE-2026-126541

WWBN AVideo versions through 29.7.1 are vulnerable to a missing authorization flaw in the Live plugin restream endpoints. By supplying arbitrary live_transmitions_history_id values, authenticated streamers can obtain the stream keys and HLS URLs of other users. Attackers can then redeem these act...

CVE-2026-126541: WWBN AVideo: WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows…

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows authenticated streamers to obtain other users' stream keys by supplying arbitrary livetransmitionshistoryid values. Attackers can redeem the issued action tokens at...

PT-2026-144920

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows authenticated streamers to obtain other users' stream keys by supplying arbitrary live transmitions history id values. Attackers can redeem the issued action tokens at...

EUVD-2026-78641

WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticated attackers can retrieve restricted live transmission details including stream keys, titles, descriptions, owner information, and direct H...

CVE-2026-90543

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. The script reads the key and msg parameters from $REQUEST, resolves the stream owner via...

CVE-2026-90543 WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. The script reads the key and msg parameters from $REQUEST, resolves the stream owner via...

CVE-2026-90543 WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. The script reads the key and msg parameters from $REQUEST, resolves the stream owner via...

CVE-2026-90543 WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. The script reads the key and msg parameters from $REQUEST, resolves the stream owner via...

CVE-2026-90543

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. The script reads the "key" and "msg" parameters from $REQUEST, resolves the stream owner via...

EUVD-2026-76861

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. The script reads the key and msg parameters from $REQUEST, resolves the stream owner via...

CVE-2026-90543

WWBN AVideo (with the Live plugin enabled) contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. The script resolves the stream owner via LiveTransmition::keyExists and checks that the owner is an administrator, but performs no User::isLogged() check and ...

CVE-2026-86727 AVideo through 29.0 Information Disclosure via stats.json.php

AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerate private, unlisted, and group-restricted live...

CVE-2026-86727 AVideo through 29.0 Information Disclosure via stats.json.php

AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerate private, unlisted, and group-restricted live...

CVE-2026-85162

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacki...

CVE-2026-82645

AVideo (commit e01e41ecc and earlier) is vulnerable to unauthenticated stream credential disclosure via the getLiveKey.json.php endpoint. Supplying a forged token parameter bypasses both the access gate and ownership check, returning any user's stream_key and stream_url — credentials for external...