Executive brief
AVideo is a platform for streaming live and on-demand video content. The plugin/PlayLists/epg.json.php endpoint lacks authentication controls, allowing unauthenticated attackers to retrieve sensitive live-stream credentials, server identifiers, and complete programme schedules by directly requesting the endpoint with user or playlist IDs. This exposes viewing credentials for restricted live streams and enables enumeration of private playlists.
Technical details
The vulnerability is an authentication bypass in plugin/PlayLists/epg.json.php caused by missing authentication checks (CWE-306). The endpoint reads $_REQUEST['playlists_id'] and $_REQUEST['users_id'] directly and serializes EPG objects without calling the PlayLists::showOnTV() filter applied by sibling endpoints (epg.xml.php, iptv.php). This filter prevents exposure of private/non-TV playlists. The returned EPG object contains the live-stream key credential (normally admin-gated), live_servers_id, M3U8 links, and programme schedules. No authentication primitives (User::isLogged(), isAdmin(), isTokenValid()) are present. Attack vector is network-based, requiring no authentication or user interaction; attackers can enumerate users/playlists via sequential IDs. Patched versions: None available at time of disclosure.
Affected products
- WWBN AVideo through 29.0
Timeline
- 2026-08-24: disclosed: GitHub Security Advisory (GHSA-xpr5-7246-qvh5) published
- 2026-09-08: advisory: CVE-2026-86728 assigned