CVE-2026-91965: WWBN AVideo Information Disclosure Flaw

CVE-2026-91965 Overview

CVE-2026-91965 is a broken access control vulnerability in WWBN AVideo through version 29.0. The flaw resides in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints, which fail to enforce user-group restrictions. Unauthenticated attackers can query these endpoints over the network and retrieve restricted live transmission metadata. Disclosed data includes stream keys, transmission titles, descriptions, owner information, and direct HTTP Live Streaming (HLS) playback URLs. The issue is tracked as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can harvest private stream keys and HLS URLs, enabling stream hijacking and unauthorized viewing of restricted content.

Affected Products

WWBN AVideo versions through 29.0
AVideo plugin/Live/stats.json.php endpoint
AVideo plugin/Live/calendar.json.php endpoint

Discovery Timeline

2026-09-15 - CVE-2026-91965 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91965

Vulnerability Analysis

AVideo is an open-source video streaming platform that supports live transmissions through a Live plugin. The plugin exposes JSON endpoints intended to serve stats and scheduling data to authorized users. Under normal operation, these endpoints should honor per-user and per-group visibility rules configured for each live transmission.

The vulnerable endpoints skip the authorization step entirely. Any HTTP client can request plugin/Live/stats.json.php or plugin/Live/calendar.json.php and receive a JSON payload containing details for restricted transmissions. The response includes fields that are meant to remain private, such as the live stream key used to authenticate publishing sessions and the direct HLS playback URL used by the player.

An attacker with a leaked stream key can push arbitrary content into the affected channel or reuse the key to impersonate the broadcaster. Direct HLS URLs allow silent consumption of restricted streams without the platform's access checks.

Root Cause

The root cause is missing authorization logic in the two Live plugin JSON handlers. Neither endpoint validates the requesting session against the user-group membership defined for a given transmission before serializing sensitive attributes into the response. This is a classic instance of [CWE-200] information exposure resulting from broken access control.

Attack Vector

Exploitation requires only network reachability to the AVideo host. No credentials, user interaction, or elevated privileges are needed. The attacker issues an HTTP GET request to either endpoint and parses the returned JSON for stream keys, owner identifiers, titles, descriptions, and playback URLs. See the GitHub Security Advisory GHSA-4xhp-wjpj-p92w and the VulnCheck Advisory for AVideo for endpoint specifics.

Detection Methods for CVE-2026-91965

Indicators of Compromise

Unauthenticated HTTP GET requests to /plugin/Live/stats.json.php or /plugin/Live/calendar.json.php from external IP ranges.
Repeated JSON responses returning transmission records that include stream key or HLS URL fields to unauthenticated clients.
Unexpected publishing sessions on live channels originating from IP addresses not associated with the legitimate broadcaster.

Detection Strategies

Review web server access logs for high-volume or scripted access patterns against the two Live plugin endpoints.
Alert on any request to these endpoints that lacks a valid authenticated session cookie or API token.
Correlate stream ingest events with prior access to stats.json.php or calendar.json.php to identify potential key reuse.

Monitoring Recommendations

Enable verbose access logging on the AVideo web tier and forward logs to a centralized analytics platform for retention and search.
Baseline normal request volume for Live plugin endpoints and alert on statistical deviations.
Monitor RTMP or WebRTC publishing sources for stream keys used from unexpected geolocations or ASNs.

How to Mitigate CVE-2026-91965

Immediate Actions Required

Restrict network access to plugin/Live/stats.json.php and plugin/Live/calendar.json.php at the reverse proxy or WAF layer until a patched build is deployed.
Rotate all live stream keys for restricted transmissions, since prior disclosure cannot be ruled out.
Audit recent access logs for the two endpoints and identify any transmissions whose keys should be considered compromised.

Patch Information

Refer to the upstream GitHub Security Advisory GHSA-4xhp-wjpj-p92w for the fixed release information and remediation guidance from the WWBN AVideo project. Upgrade beyond version 29.0 as soon as a corrected build is available.

Workarounds

Block or return HTTP 403 for unauthenticated requests to the two Live plugin endpoints using an nginx or Apache rule.
Place the AVideo administrative and Live plugin paths behind a VPN or IP allowlist while a fix is pending.
Disable the Live plugin if live transmission functionality is not required in the deployment.

bash

# Example nginx snippet to require authentication on affected endpoints
location ~ ^/plugin/Live/(stats|calendar)\.json\.php$ {
    satisfy all;
    allow 10.0.0.0/8;
    deny all;
    auth_basic "AVideo Live Admin";
    auth_basic_user_file /etc/nginx/.htpasswd;
}