The vulnerability exists in AVideo version c3edcc274c389816d434acadac07ee78eaf330c1, where the Live::_getStats() endpoint fails to enforce the password protection on live streams. As a result, unauthenticated users receive the RTMP stream key, a flag indicating that the stream is password protected, and the HLS m3u8 playback URL. The bundled NGINX configuration then serves the .m3u8 playlist, the AES‑128 decryption key file, and the TS segments from the /live location without any authentication checks. This combination allows any remote actor to acquire all necessary materials to view a stream that is intended to be restricted, exposing the content without the configured password and violating confidentiality. The weakness falls under the Information Exposure category (CWE‑200).

The affected product is AVideo from the vendor WWBN. The flaw was identified in the repository’s master branch at revision c3edcc274c389816d434acadac07ee78eaf330c1, committed on 2026‑08‑23. A patched release had not been published at the time of the advisory; therefore all installations built from that revision remain vulnerable unless actively mitigated.

The flaw is assigned a CVSS score of 8.7, which classifies it as high severity. No EPSS score is available, indicating limited data on exploitation frequency. It is not listed in CISA’s KEV catalogue. The bug can be triggered from any network edge without authentication by simply requesting the public stats endpoint or accessing the /live path; this makes it straightforward for remote attackers to collect the stream key, the hidden password‑protected flag, and the decryption key, effectively bypassing access controls and allowing continuous viewing of the Protected stream.