CVE-2026-91965
Received Received - Intake

Unauthenticated Access to Live Stream Data in AVideo

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticated attackers can retrieve restricted live transmission details including stream keys, titles, descriptions, owner information, and direct HLS playback URLs by accessing these endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91965
EUVD
EUVD-2026-78641

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wwbn avideo to 29.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-91965 is a Broken Access Control vulnerability in WWBN AVideo through version 29.0. It allows unauthenticated attackers to access restricted live transmission details via two endpoints: plugin/Live/stats.json.php and plugin/Live/calendar.json.php. These endpoints expose sensitive data like stream keys, HLS playback URLs, titles, descriptions, and owner information even when transmissions are restricted to specific user groups.

Detection Guidance

Check if the vulnerable endpoints are accessible by sending HTTP GET requests to plugin/Live/stats.json.php and plugin/Live/calendar.json.php. If they return sensitive data without authentication, the system is likely vulnerable. Example commands: curl -v http://<target>/plugin/Live/stats.json.php and curl -v http://<target>/plugin/Live/calendar.json.php.

Impact Analysis

This vulnerability allows unauthorized access to restricted live streams and their metadata. Attackers could obtain stream keys and direct HLS URLs, enabling them to view private streams without authentication. It also exposes sensitive information like channel details and owner identities, potentially leading to further exploitation or data breaches.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA by exposing sensitive personal data without authorization. GDPR requires protecting personal data, while HIPAA mandates securing protected health information. Unauthorized access to live streams containing such data could result in compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Apply the vendor-suggested patches to enforce access control in the affected endpoints. Specifically, add checks in objects/functions.php and plugin/Live/Live.php to filter restricted transmissions. Remove the hidden_applications array from stats.json.php output and mask stream keys in responses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91965. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart