Executive brief
AVideo is a self-hosted video streaming platform that includes a Live plugin for broadcasting protected streams. Password-protected live transmissions are supposed to require viewer authentication, but the application fails to enforce this check on two fronts: the statistics API endpoint leaks the stream key and HLS playlist URL to any unauthenticated user, and the NGINX reverse proxy configuration serves the encrypted video segments without authentication. An attacker can therefore watch password-protected broadcasts without providing the correct password.
Technical details
The vulnerability is a missing authorization check affecting two code paths. First, Live::_getStats() in plugin/Live/Live.php does not call Live::checkIfPasswordIsGood() before adding password-protected transmission metadata to its public API response; it exposes the RTMP stream key, HLS URL (m3u8 file), and isPasswordProtected flag to unauthenticated callers. Second, the shipped NGINX configuration (deploy/nginx/nginx.conf) serves the /live endpoint—containing .m3u8 playlists, AES-128 decryption keys, and transport-stream video segments—without any auth_request directive (the only auth_key_check is commented out). An unauthenticated attacker can exploit both flaws via network-level HTTP requests: fetch the stats endpoint to obtain the HLS URL and AES key path, then download the unencrypted or decryptable video segments directly. The normal watch route does enforce the password check, but the stats and HLS paths bypass it entirely. No patched version was available at the time of advisory publication.
Affected products
- WWBN AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (2026-08-23)
Timeline
- 2026-08-26: disclosed: GitHub Security Advisory GHSA-7h6j-2gh9-h9rw published
- 2026-09-10: advisory: CVE-2026-88874 assigned and published on NVD