CVE-2026-86728 Overview
CVE-2026-86728 is an authentication bypass vulnerability in AVideo through version 29.0. The flaw resides in plugin/PlayLists/epg.json.php, which exposes live-stream keys and private Electronic Programme Guide (EPG) schedules to unauthenticated users. Attackers can iterate through sequential user or playlist identifiers to harvest sensitive credentials, server identifiers, and complete programme schedules without any authentication. The issue is tracked under CWE-306: Missing Authentication for Critical Function.
Critical Impact
Unauthenticated remote attackers can enumerate and exfiltrate live-stream keys, server identifiers, and private EPG data from any exposed AVideo instance up to version 29.0.
Affected Products
- WWBN AVideo through version 29.0
- AVideo PlayLists plugin endpoint epg.json.php
- Deployments exposing the AVideo web interface to untrusted networks
Discovery Timeline
- 2026-09-08 - CVE-2026-86728 published to the National Vulnerability Database
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-86728
Vulnerability Analysis
The vulnerability exists in the AVideo PlayLists plugin, specifically in the epg.json.php endpoint. The endpoint returns EPG data and associated stream metadata as JSON but does not verify that the requester holds a valid session or authorization token. Any anonymous HTTP client can query the endpoint directly and receive sensitive playlist and stream data in response.
Because the endpoint accepts user and playlist identifiers as request parameters, attackers can script sequential ID enumeration to iterate across the entire dataset. Each response leaks live-stream keys used to authorize playback, server identifiers, and full private programme schedules. Disclosed stream keys can then be reused by third parties to hijack or rebroadcast protected streams.
Root Cause
The root cause is a missing authentication check on a sensitive plugin endpoint [CWE-306]. The epg.json.php handler processes requests and returns confidential playlist data without invoking the session validation and access-control logic that other AVideo endpoints enforce. The design assumes public exposure of EPG data is acceptable, but the response also includes private stream credentials that must remain restricted.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction. An attacker sends HTTP GET requests to plugin/PlayLists/epg.json.php with sequentially incremented users_id or playlists_id parameters. Each response returns JSON containing stream keys and EPG schedules. Automation trivially harvests the full dataset from any reachable AVideo instance. See the VulnCheck advisory and the GitHub Security Advisory GHSA-xpr5-7246-qvh5 for additional technical context.
Detection Methods for CVE-2026-86728
Indicators of Compromise
- Unauthenticated HTTP requests to /plugin/PlayLists/epg.json.php in web server access logs
- Sequential enumeration patterns against the endpoint using incrementing users_id or playlists_id values
- Bursts of requests from a single client IP returning HTTP 200 responses with JSON payloads containing stream keys
- Unexpected reuse of live-stream keys from IP addresses or geographies inconsistent with legitimate subscribers
Detection Strategies
- Alert on any access to epg.json.php that lacks a valid authenticated session cookie or authorization header
- Deploy web application firewall (WAF) rules to identify high-volume, low-diversity enumeration against AVideo plugin endpoints
- Correlate access logs with authentication logs to find requests that returned sensitive JSON without a preceding successful login
Monitoring Recommendations
- Ingest AVideo web server logs into a centralized log platform and baseline normal request patterns for plugin/PlayLists/*
- Monitor for spikes in outbound bandwidth from stream servers that could indicate credential reuse and unauthorized playback
- Track newly observed source IPs querying the EPG endpoint and flag those issuing rapid sequential ID requests
How to Mitigate CVE-2026-86728
Immediate Actions Required
- Restrict network access to plugin/PlayLists/epg.json.php at the reverse proxy or WAF until a vendor patch is applied
- Rotate all live-stream keys and server identifiers that may have been exposed through the vulnerable endpoint
- Audit web server access logs for prior unauthenticated requests to the endpoint and treat matching stream keys as compromised
Patch Information
Refer to the GitHub Security Advisory GHSA-xpr5-7246-qvh5 for the authoritative patch status and remediation guidance from the AVideo maintainers. Upgrade AVideo beyond version 29.0 once a fixed release is published, and validate that the epg.json.php endpoint enforces session authentication after upgrade.
Workarounds
- Disable the PlayLists plugin if EPG functionality is not required in the deployment
- Add a reverse-proxy authentication gate (for example, HTTP basic auth or mutual TLS) in front of the plugin/PlayLists/ path
- Block direct external access to epg.json.php with WAF or web server rules and permit only trusted internal callers
- Enforce rate limiting on plugin endpoints to slow enumeration attempts while a permanent fix is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.