CVE-2026-89250: WWBN AVideo Auth Bypass Vulnerability

CVE-2026-89250 Overview

CVE-2026-89250 is an unauthenticated file read vulnerability in WWBN AVideo, an open-source video streaming platform. The flaw resides in the getRecordedFile.php endpoint, which streams recorded FLV files from the temporary directory without enforcing authentication or authorization. Attackers can request the endpoint with a known or guessed stream key to download recorded live video content. The vulnerability affects WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 and is classified under [CWE-306: Missing Authentication for Critical Function].

Critical Impact
Remote, unauthenticated attackers can retrieve recorded live stream video files by requesting getRecordedFile.php with a valid stream key, exposing potentially sensitive broadcast content.

Affected Products

WWBN AVideo streaming platform
All builds through commit c3edcc274c389816d434acadac07ee78eaf330c1
Deployments exposing getRecordedFile.php to the network

Discovery Timeline

2026-09-11 - CVE-2026-89250 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89250

Vulnerability Analysis

WWBN AVideo exposes getRecordedFile.php to serve recorded FLV video segments generated by live streams. The endpoint reads files from the temporary directory and streams them to the requesting client. The handler does not verify the caller's session, role, or ownership of the recorded content. Any network-reachable client that presents a valid stream key receives the corresponding recording.

The vulnerability is scoped to confidentiality: it enables direct read access to recorded video content without altering server state. Because live streams may contain private broadcasts, staged content, or unreleased material, unauthorized retrieval represents a meaningful data exposure for operators.

Root Cause

The root cause is missing authentication and authorization checks on a file-serving endpoint [CWE-306]. getRecordedFile.php treats knowledge of the stream key as sufficient proof of access rights. Stream keys are not designed as high-entropy authentication secrets, so guessing, enumeration, or leakage through logs and referrer headers permits access.

Attack Vector

Exploitation is fully remote and requires no user interaction or credentials. An attacker sends an HTTP GET request to getRecordedFile.php supplying a stream key parameter. If the referenced FLV file exists in the temporary directory, the server streams the recording back in the HTTP response. Attackers can enumerate keys through brute force, harvest them from public schedules, or capture them from client-side JavaScript. See the GitHub Security Advisory and the VulnCheck Advisory for reference details.

Detection Methods for CVE-2026-89250

Indicators of Compromise

Unauthenticated HTTP GET requests to /getRecordedFile.php originating from external IP addresses.
Sequential or high-volume requests to getRecordedFile.php with varying stream key parameters, indicating enumeration.
Outbound responses containing FLV video payloads sent to sessions without prior authenticated activity.

Detection Strategies

Inspect web server access logs for requests to getRecordedFile.php and correlate with authenticated session identifiers to flag anonymous access.
Deploy WAF rules that require an authenticated session cookie before permitting requests to the endpoint.
Baseline normal request rates to the endpoint and alert on statistical deviations that suggest key guessing.

Monitoring Recommendations

Aggregate AVideo webserver logs into a central analytics or SIEM platform for retention and query.
Track HTTP status codes and response sizes for getRecordedFile.php to identify successful unauthorized downloads.
Monitor the temporary FLV directory for large-volume outbound reads that do not match scheduled broadcasts.

How to Mitigate CVE-2026-89250

Immediate Actions Required

Restrict network access to getRecordedFile.php through reverse proxy or firewall rules until a patched build is deployed.
Rotate all active stream keys and invalidate recordings that may have been exposed.
Audit the temporary directory and purge FLV files that are no longer required for playback.

Patch Information

WWBN has published a security advisory documenting the issue. Operators should upgrade to a commit released after c3edcc274c389816d434acadac07ee78eaf330c1 that adds authentication and authorization enforcement to getRecordedFile.php. Consult the GitHub Security Advisory GHSA-crcx-7mx7-jqfr for the fixed reference and upgrade instructions.

Workarounds

Place getRecordedFile.php behind an authenticated reverse proxy that validates session cookies before forwarding requests.
Add a webserver rewrite rule that returns HTTP 403 for requests to getRecordedFile.php lacking a valid authentication cookie.
Move recorded FLV files out of the web-accessible temporary directory and serve them through an access-controlled handler.

bash

# Example nginx rule to block unauthenticated access to the endpoint
location = /getRecordedFile.php {
    if ($cookie_PHPSESSID = "") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php/php-fpm.sock;
}