CVE-2026-89250
Received Received - Intake

Unauthenticated File Read in AVideo via getRecordedFile.php

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: VulnCheck

Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint that streams recorded FLV files from the temporary directory. Attackers can request the endpoint with a known or guessed stream key to download recorded live video files without authentication or authorization checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89250
EUVD
EUVD-2026-76062

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wwbn avideo to c3edcc274c389816d434acadac07ee78eaf330c1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-89250 is an unauthenticated file read vulnerability in WWBN AVideo's getRecordedFile.php endpoint. It allows attackers to stream recorded FLV files from the temporary directory without authentication or authorization checks by using a known or guessed stream key.

Detection Guidance
  • Check for unusual requests to the getRecordedFile.php endpoint in web server logs, particularly those without authentication tokens or session cookies.
  • Use tools like curl to test if the endpoint leaks files by requesting known stream keys or file paths. Example: curl http://<target>/plugin/Live/standAloneFiles/getRecordedFile.php?file=example.flv
Impact Analysis

This vulnerability enables unauthorized access to recorded live video files, potentially exposing sensitive media content. Attackers can download FLV files from the server's temporary directory without any authentication, leading to privacy breaches or data leaks.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive media files. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. Unauthorized access may result in legal penalties and reputational damage.

Mitigation Strategies
  • Apply the latest patch or update to AVideo if available, as the vulnerability affects versions up to commit c3edcc274c389816d434acadac07ee78eaf330c1.
  • Implement strict access controls for the getRecordedFile.php endpoint, requiring authentication and authorization checks before file access.
  • Disable or restrict access to the getRecordedFile.php endpoint if not required for operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89250. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart