CVE-2026-86727: AVideo Information Disclosure Vulnerability

CVE-2026-86727 Overview

CVE-2026-86727 is an information disclosure vulnerability affecting AVideo through version 29.0. The flaw resides in the plugin/Live/stats.json.php endpoint, which exposes live stream statistics without requiring authentication. Unauthenticated remote attackers can query the endpoint and parse the hidden_applications array in the JSON response to extract stream keys and m3u8 URLs. This enables enumeration of private, unlisted, and group-restricted live streams. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function).

Critical Impact
Unauthenticated attackers can retrieve stream keys and access URLs for private, unlisted, and group-restricted live streams over the network.

Affected Products

WWBN AVideo versions through 29.0
AVideo Live plugin (plugin/Live/stats.json.php)
Self-hosted AVideo streaming platform deployments

Discovery Timeline

2026-09-08 - CVE-2026-86727 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-86727

Vulnerability Analysis

AVideo is an open-source video streaming platform maintained by WWBN. The Live plugin provides real-time statistics through a JSON endpoint intended for internal monitoring. The endpoint fails to enforce authentication or authorization checks before returning sensitive stream metadata.

The JSON response includes a hidden_applications array containing entries for streams that should not be visible to unauthenticated users. Each entry exposes the stream key and the corresponding m3u8 playlist URL. Attackers who obtain a stream key can watch protected content, and in some deployments impersonate or hijack the broadcaster session.

Root Cause

The root cause is missing authentication on a critical function [CWE-306]. The plugin/Live/stats.json.php handler returns full stream inventory data, including entries flagged as hidden, without validating the requestor's session, role, or group membership. The application relies on client-side filtering rather than server-side access control to protect private stream identifiers.

Attack Vector

Exploitation requires no privileges, no user interaction, and can be performed remotely over the network. An attacker issues an HTTP GET request to the vulnerable endpoint on any exposed AVideo instance. The attacker then parses the JSON response and extracts values from the hidden_applications array. The resulting stream keys and m3u8 URLs grant direct access to private live streams that are not indexed in the public interface.

Refer to the GitHub Security Advisory GHSA-8g4j-g3r6-73xr and the VulnCheck AVideo Information Disclosure Advisory for the full technical write-up.

Detection Methods for CVE-2026-86727

Indicators of Compromise

Unauthenticated HTTP GET requests to /plugin/Live/stats.json.php in web server access logs.
Repeated or automated requests to the stats endpoint from external IP ranges or scanning infrastructure.
Access to m3u8 playlist URLs corresponding to streams marked private, unlisted, or group-restricted.
Unexpected viewer counts on streams that were intended to remain hidden.

Detection Strategies

Review web server logs for requests to plugin/Live/stats.json.php and correlate with session or authentication state.
Alert on JSON responses from this endpoint that exceed a baseline size, indicating the hidden_applications array is being returned.
Deploy a web application firewall rule to log or block anonymous access to the Live plugin statistics path.

Monitoring Recommendations

Enable verbose access logging on the AVideo web tier and forward logs to a central platform.
Track access patterns to Live plugin endpoints and flag requests missing authentication cookies or tokens.
Monitor egress traffic for playback of streams keyed by identifiers that should not be publicly indexed.

How to Mitigate CVE-2026-86727

Immediate Actions Required

Restrict network access to plugin/Live/stats.json.php at the reverse proxy or web server layer until a patched release is applied.
Rotate all existing live stream keys, since prior exposure of the endpoint may have leaked them.
Audit web server logs for prior anonymous requests to the affected endpoint and identify potentially disclosed stream identifiers.

Patch Information

Refer to the upstream GitHub Security Advisory GHSA-8g4j-g3r6-73xr for fix availability and upgrade guidance. Deploy any vendor-supplied release beyond AVideo 29.0 that addresses the missing authentication check in the Live plugin.

Workarounds

Block or require authentication for the /plugin/Live/stats.json.php path using web server or reverse proxy access rules.
Disable the Live plugin on instances that do not require live streaming until an upgrade is available.
Place the AVideo instance behind a VPN or IP allowlist if the platform is used for private broadcasting only.

bash

# Example nginx configuration to deny anonymous access to the vulnerable endpoint
location = /plugin/Live/stats.json.php {
    allow 10.0.0.0/8;
    deny all;
    return 403;
}