CVE-2026-86726: AVideo Information Disclosure Vulnerability

CVE-2026-86726 Overview

CVE-2026-86726 is an information disclosure vulnerability in AVideo through version 29.0. The flaw resides in restreamsActive.json.php, which fails to filter results by user ownership. Any authenticated streamer can query the endpoint and enumerate source stream keys and identities belonging to all other streamers with active restreams. The exposed data includes transmission credentials that can be used to hijack broadcasts or impersonate legitimate streamers. The vulnerability is categorized under [CWE-522] Insufficiently Protected Credentials.

Critical Impact
Authenticated users with streaming capability can harvest stream keys and streamer identities across the entire platform, enabling credential theft, broadcast hijacking, and impersonation.

Affected Products

AVideo (WWBN) versions through 29.0
Deployments exposing the restreamsActive.json.php endpoint
Multi-tenant AVideo instances with more than one streamer account

Discovery Timeline

2026-09-08 - CVE CVE-2026-86726 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86726

Vulnerability Analysis

AVideo is an open-source video streaming and content management platform maintained by WWBN. The application supports live restreaming, where streamers push a source stream to AVideo and the platform redistributes it to configured destinations such as YouTube, Twitch, or Facebook Live. Source stream keys act as bearer credentials for these outbound sessions.

The restreamsActive.json.php endpoint returns a JSON payload listing currently active restream sessions. The endpoint enforces authentication and confirms that the caller holds streamer privileges, but omits an ownership check on the returned records. As a result, every authenticated streamer receives the complete active-restream set, including entries owned by other users.

Because the payload contains source stream keys and streamer identity fields, an attacker with a low-privilege streamer account can enumerate credentials belonging to all other broadcasters. Stolen keys enable attackers to inject content into legitimate broadcasts, redirect streams, or take over restream destinations without triggering credential-reset workflows.

Root Cause

The root cause is missing authorization at the object level. The controller filters by session role but not by the record owner's user identifier. This is a broken access control pattern where authentication is verified while per-record authorization is not, aligning with [CWE-522] because the leaked data functions as reusable credential material.

Attack Vector

Exploitation requires a valid AVideo account with streaming capability and network access to the application. The attacker authenticates, requests restreamsActive.json.php, and parses the JSON response to extract other streamers' source keys and identities. No user interaction from the victim is required, and the request pattern is indistinguishable from legitimate polling used by the dashboard.

Refer to the GitHub Security Advisory and the VulnCheck Advisory on AVideo for additional technical context. No public proof-of-concept exploit code has been verified at the time of writing.

Detection Methods for CVE-2026-86726

Indicators of Compromise

Unexpected GET requests to restreamsActive.json.php from accounts that do not currently operate restreams.
Repeated polling of restreamsActive.json.php from a single session at intervals shorter than the dashboard refresh cadence.
Restream destinations reconfigured or content injected on streams whose owners did not authenticate at the time of change.

Detection Strategies

Enable verbose access logging on the AVideo web server and alert on non-owner accounts requesting restreamsActive.json.php.
Correlate stream key usage against the account that owns the key; usage from a new IP or user-agent without a prior login event indicates key reuse.
Baseline the expected request rate per streamer account and alert on outliers that suggest enumeration.

Monitoring Recommendations

Forward AVideo application and web server logs to a centralized analytics pipeline for retention and correlation.
Monitor RTMP and SRT ingest endpoints for concurrent sessions using the same stream key from distinct source addresses.
Track administrative actions on restream destinations and alert on modifications performed outside maintenance windows.

How to Mitigate CVE-2026-86726

Immediate Actions Required

Restrict access to restreamsActive.json.php at the reverse proxy or web application firewall until a patched build is deployed.
Rotate all active stream keys for every streamer account, prioritizing accounts with restreams to third-party platforms.
Audit recent access logs for requests to restreamsActive.json.php and identify accounts that may have harvested credentials.

Patch Information

Consult the GitHub Security Advisory GHSA-qh45-c3p8-jh4g for the vendor's fixed version and upgrade instructions. Apply the patched release from the WWBN AVideo repository once available and verify that restreamsActive.json.php filters returned records by the authenticated user's identifier.

Workarounds

Block or ACL the restreamsActive.json.php route at the reverse proxy so only trusted administrative addresses can reach it.
Temporarily disable the restream feature for non-administrative accounts if the endpoint cannot be firewalled.
Reduce the streamer role membership to the minimum set of users required for production broadcasts.

bash

# Nginx snippet restricting access to the vulnerable endpoint
location = /plugin/Live/standAloneFiles/restreamsActive.json.php {
    allow 10.0.0.0/24;   # trusted admin subnet
    deny  all;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}