Executive brief
AVideo is a platform for managing and streaming live video content. An attacker can access the stats.json.php endpoint without any authentication to retrieve sensitive live streaming credentials—including stream keys and HLS URLs—for private, unlisted, and restricted streams that should not be publicly visible. This allows unauthorized viewers to discover hidden live streams and potentially access their content.
Technical details
A missing authentication vulnerability exists in plugin/Live/stats.json.php, which exposes a JSON endpoint gated only on the Live plugin being enabled. The endpoint invokes getStatsNotifications() → Live::getStats() → Live::_getStats() while running as an anonymous user (User::getId()==0), routing non-visible streams to a hidden_applications array that retains raw stream credentials: the stream key and m3u8 URL. The vulnerable code paths at Live.php:2408–2413 and Live.php:2493–2502 push these secrets into the hidden_applications bucket without redaction. Since stats.json.php:60 echoes the entire JSON structure and no authentication checks guard the endpoint, an unauthenticated attacker can enumerate all currently-live private/unlisted/group-restricted streams and obtain their stream keys and direct HLS URLs by making a simple GET request.
Affected products
- WWBN AVideo through 29.0
Timeline
- 2026-08-24: disclosed
- 2026-09-08: advisory