CVE-2026-40907: Wwbn Avideo Information Disclosure Flaw

CVE-2026-40907 Overview

CVE-2026-40907 is an Insecure Direct Object Reference (IDOR) vulnerability affecting WWBN AVideo, an open source video platform. The vulnerability exists in the endpoint plugin/Live/view/Live_restreams/list.json.php and allows any authenticated user with streaming permission to retrieve other users' live restream configurations. This includes sensitive third-party platform stream keys and OAuth tokens (access_token, refresh_token) for services like YouTube Live, Facebook Live, and Twitch.

Critical Impact

Authenticated attackers can steal OAuth tokens and stream keys from other users, potentially allowing unauthorized access to third-party streaming platforms and hijacking of live streaming sessions.

Affected Products

• WWBN AVideo versions 29.0 and prior
• All installations using the Live restreams plugin
• Users with third-party streaming integrations (YouTube Live, Facebook Live, Twitch)

Discovery Timeline

• 2026-04-21 - CVE-2026-40907 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-40907

Vulnerability Analysis

This IDOR vulnerability stems from improper access control in the live restreams JSON endpoint. The vulnerable code fails to properly enforce user ownership validation when processing requests for restream configuration data. When a user with streaming permissions makes a request to the list.json.php endpoint, the application does not adequately verify that the requesting user is authorized to view the specific restream configurations being requested.

The impact is significant because the exposed data includes highly sensitive OAuth credentials (access tokens and refresh tokens) used for integration with major streaming platforms. An attacker could leverage these tokens to hijack streaming sessions on YouTube Live, Facebook Live, or Twitch, potentially causing reputational damage or broadcasting unauthorized content under another user's identity.

Root Cause

The root cause lies in the flawed user ID handling logic within the list.json.php endpoint. The vulnerable code only restricts administrative access to all users' data but fails to properly enforce that non-admin users can only access their own restream configurations. When the users_id parameter is manipulated or omitted by a non-admin user, the authorization check was insufficient to prevent access to other users' sensitive configuration data.

Attack Vector

The vulnerability is exploitable over the network by any authenticated user who has streaming permissions on the AVideo platform. The attack requires low privileges and no user interaction. An attacker can exploit this vulnerability by:

1. Authenticating to the AVideo platform with a valid user account that has streaming permissions
2. Making HTTP requests to the vulnerable endpoint plugin/Live/view/Live_restreams/list.json.php
3. Manipulating or omitting the users_id parameter to access other users' restream configurations
4. Extracting stream keys and OAuth tokens from the JSON response

// Vulnerable code - Improper user ID handling for non-admins in live restreams JSON response
// Source: https://github.com/WWBN/AVideo/commit/d5992fff2811df4adad1d9fc7d0a5837b882aed7

-<?php
-require_once '../../../../videos/configuration.php';
-require_once $global['systemRootPath'] . 'plugin/Live/Objects/Live_restreams.php';
-header('Content-Type: application/json');
-
-if (!User::canStream()) {
-    die('{"data": []}');
-}
-
-if (empty($_GET['users_id'])) {
-    if (!User::isAdmin()) {
-        $_GET['users_id'] = User::getId();
-    }
-}
-
-if (empty($_GET['users_id'])) {
-    $rows = Live_restreams::getAll();
-} else {
-    $rows = Live_restreams::getAllFromUser($_GET['users_id'], "");
-}
-
-foreach ($rows as $key => $value) {
-    $rows[$key]['stream_key_short'] = getSEOTitle($value['stream_key'],20);
-}
-?>
-{"data": <?php echo json_encode($rows); ?>}
+<?php
+require_once '../../../../videos/configuration.php';
+require_once $global['systemRootPath'] . 'plugin/Live/Objects/Live_restreams.php';

Source: GitHub Commit Change

Detection Methods for CVE-2026-40907

Indicators of Compromise

• Unusual HTTP requests to /plugin/Live/view/Live_restreams/list.json.php with manipulated users_id parameters
• Multiple sequential requests to the vulnerable endpoint from a single user session targeting different user IDs
• Access logs showing requests for restream data from users who don't own the requested configurations
• Reports of unauthorized streaming activity on linked third-party platforms

Detection Strategies

• Monitor web application logs for requests to list.json.php with users_id parameters that don't match the authenticated user
• Implement anomaly detection for users accessing restream configuration data at unusual rates or patterns
• Review access logs for authenticated users querying multiple different user IDs in sequence
• Set up alerts for failed authorization attempts or unusual parameter enumeration patterns

Monitoring Recommendations

• Enable detailed logging on the AVideo application to capture all requests to the Live restreams endpoints
• Configure SIEM rules to alert on potential IDOR exploitation attempts (sequential user ID enumeration)
• Monitor third-party streaming platform integrations for unauthorized access or streaming activity
• Review authentication and session logs for accounts that may have been compromised through credential theft

How to Mitigate CVE-2026-40907

Immediate Actions Required

• Update WWBN AVideo to a version containing commit d5992fff2811df4adad1d9fc7d0a5837b882aed7 or later
• Audit access logs for any signs of prior exploitation targeting the vulnerable endpoint
• Consider rotating all OAuth tokens and stream keys for third-party streaming integrations
• Temporarily disable the Live restreams feature if immediate patching is not possible

Patch Information

The vulnerability has been addressed in commit d5992fff2811df4adad1d9fc7d0a5837b882aed7. Organizations running WWBN AVideo version 29.0 or earlier should apply this patch immediately. The fix improves user ID handling for non-admin users in the live restreams JSON response, ensuring proper authorization checks are enforced.

For detailed patch information, refer to the GitHub Commit Change and the GitHub Security Advisory.

Workarounds

• Restrict access to the /plugin/Live/view/Live_restreams/ directory using web server access controls
• Implement network-level restrictions to limit access to the AVideo admin and API endpoints
• Disable the Live plugin entirely if live streaming functionality is not required
• Deploy a Web Application Firewall (WAF) rule to block requests with manipulated users_id parameters to the vulnerable endpoint

# Apache .htaccess configuration to restrict access to vulnerable endpoint
<Files "list.json.php">
    <RequireAll>
        Require valid-user
        # Additional IP-based restriction for admin access only
        Require ip 10.0.0.0/8 192.168.0.0/16
    </RequireAll>
</Files>