Description
AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerate private, unlisted, and group-restricted live streams by parsing the hidden_applications array in the JSON response to obtain sensitive streaming credentials.
Published: 2026-09-08
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an unauthenticated information disclosure flaw, identified as CWE-306, located in the plugin/Live/stats.json.php file of AVideo versions through 29.0. It enables attackers to retrieve stream keys and m3u8 URLs by accessing the exposed endpoint without authentication. By parsing the hidden_applications array in the JSON response, an attacker can enumerate private, unlisted, and group-restricted live streams, thereby accessing sensitive streaming credentials and potentially violating confidentiality and availability of the content.

Affected Systems

The vulnerability affects the WWBN AVideo platform, specifically all releases up to and including version 29.0. Users running these or older versions are susceptible to the data leak.

Risk and Exploitability

The flaw carries a CVSS score of 8.7, indicating a high severity. The EPSS score is not available, and the vulnerability has not been listed in the CISA KEV catalog. Attackers need only send an HTTP request to the publicly exposed stats.json.php endpoint; no prior authentication or privileged access is required. The risk is therefore direct and immediate for any unpatched installation.

Generated by OpenCVE AI on September 8, 2026 at 17:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest AVideo update that addresses the stats.json.php information disclosure
  • Configure the web server or application firewall to restrict access to the /plugin/Live/stats.json.php endpoint, requiring authentication or removing it from public reach — an approach to address the CWE-306 weakness.
  • Audit server logs for unauthorized requests to stats.json.php and investigate any unusual activity

Generated by OpenCVE AI on September 8, 2026 at 17:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Description AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerate private, unlisted, and group-restricted live streams by parsing the hidden_applications array in the JSON response to obtain sensitive streaming credentials.
Title AVideo through 29.0 Information Disclosure via stats.json.php
First Time appeared Wwbn
Wwbn avideo
Weaknesses CWE-306
CPEs cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*
Vendors & Products Wwbn
Wwbn avideo
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Wwbn Avideo
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-08T15:13:58.860Z

Reserved: 2026-09-08T11:30:41.420Z

Link: CVE-2026-86727

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-09-08T16:18:33.823

Modified: 2026-09-08T19:53:13.400

Link: CVE-2026-86727

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-08T17:30:05Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function