CVE-2026-33716

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the standalone live stream control endpoint at "plugin/Live/standAloneFiles/control.json.php" accepts a user-supplied "streamerURL" parameter that overrides where the server sends token verification requests. An...