WWBN AVideo, an open source video platform, has an IDOR flaw in the Live restream list endpoint that lets any authenticated user with streaming permission view other users’ live restream configurations. The data exposed includes third‑party platform stream keys and OAuth tokens for YouTube Live, Facebook Live, and Twitch, which could be used to hijack streams or impersonate channels. CWE‑639 indicates that the vulnerability arises from improper authorization controls.

Versions of WWBN AVideo up to and including 29.0 are affected. The issue specifically targets the plugin/Live/view/Live_restreams/list.json.php endpoint, which collects configuration data for live restreams. Users running an affected version of the open source platform should verify their installation against the latest code release.

The vulnerability has a CVSS score of 6.5, reflecting moderate severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The attack requires the attacker to be authenticated and to have streaming permissions, after which they can directly fetch the target data through the vulnerable endpoint. The most likely attack vector is an internal user or compromised account leveraging normal streaming privileges to request or export the configuration of other users. Given the sensitivity of stream keys and OAuth tokens, any successful exploitation can lead to significant account compromise and service disruptions.