Executive brief
AVideo is a live streaming platform that allows multiple content creators to broadcast and manage video streams. A flaw in the restreamsActive.json.php endpoint allows any authenticated streamer to view the active transmission credentials (source stream keys) and identities of all other streamers on the platform, even though they should only see their own. This exposes sensitive broadcast credentials across all user accounts and could enable unauthorized access to other streamers' content or account takeovers.
Technical details
The vulnerability is an incorrect authorization flaw (CWE-863) combined with insufficiently protected credentials (CWE-522) in the restreamsActive.json.php endpoint. The endpoint checks only that a user has canStream() capability or is an admin, but fails to filter results by user ownership. It calls getRestreamsRuning() which extracts all active ffmpeg restream processes from the system via ps aux and regex matching, then returns every active process's source stream key and associated metadata (restream_name, live_title, users_id) without any per-user filtering. An authenticated streamer can directly call GET /plugin/Live/view/restreamsActive.json.php to retrieve a JSON response containing source keys and identities for all other streamers' active restreams. The fix requires filtering results by User::getId() for non-admin users, consistent with sibling endpoints like getActiveLives.json.php. No patch has been released; the vulnerability is present in version 29.0 and earlier.
Affected products
- WWBN AVideo through 29.0
Timeline
- 2026-08-24: disclosed: Published on GitHub Security Advisory
- 2026-09-08: advisory: CVE-2026-86726 published on NVD