CVE-2026-86726

Deferred Deferred - Pending Action

AVideo Information Disclosure in Active Streams

Publication date: 2026-09-08

Last updated on: 2026-09-19

Assigner: VulnCheck

Description

AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticated streamers to enumerate source stream keys and identities of all other streamers' active restreams. The endpoint fails to filter results by user ownership, exposing sensitive transmission credentials and streamer identity across all accounts to any user with streaming capability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-19

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86726

Affected Vendors & Products

Vendor	Product	Version / Range
avideo	avideo	29.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

AVideo through version 29.0 has an information disclosure vulnerability in the restreamsActive.json.php file. This flaw allows authenticated streamers to view source stream keys and identities of all other active streamers. The issue occurs because the endpoint does not restrict data access based on user ownership, exposing sensitive stream credentials and identities across all accounts to any user with streaming privileges.

Detection Guidance

Check for unauthorized access to restreamsActive.json.php by monitoring HTTP requests to this endpoint. Look for repeated or unusual queries from authenticated users that return large datasets of stream keys and identities.

Impact Analysis

This vulnerability allows attackers with streaming access to steal source stream keys and identities of other streamers. This could lead to unauthorized access to live streams, potential redistribution of content, or impersonation of other streamers. Sensitive transmission credentials may be exposed, enabling further attacks on the platform or connected services.

Compliance Impact

This vulnerability likely violates data protection regulations such as GDPR and HIPAA by exposing personally identifiable information (PII) and sensitive stream data without proper authorization. It undermines confidentiality requirements and may result in non-compliance penalties, legal liabilities, and reputational damage for organizations using the affected AVideo software.

Mitigation Strategies

Update AVideo to the latest version if available. Restrict access to restreamsActive.json.php by implementing proper authentication and authorization checks. Review and revoke any exposed stream keys to prevent unauthorized access.

Hi! I’m here to help you understand CVE-2026-86726. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70