Executive brief
WWBN AVideo is a video streaming and live broadcast platform. The getRecordedFile.php endpoint in the Live plugin fails to authenticate users and exposes recorded FLV video files from the temporary directory. An attacker with knowledge of a stream key can download private or password-protected recorded videos without any authentication, potentially exposing sensitive broadcast content.
Technical details
The vulnerability is a missing authentication check (CWE-306) in the plugin/Live/standAloneFiles/getRecordedFile.php endpoint. The script ships with a safety guard comment-disabled via a commented-out die statement on line 3, does not include configuration.php, does not verify user login status, and fails to validate Live owner tokens. An attacker can craft a request to the endpoint with a guessed or known stream key (often derived from public Live JSON endpoints or predictable naming patterns) and retrieve FLV files via a GET request to /plugin/Live/standAloneFiles/getRecordedFile.php?file=streamkey. The script sanitizes the filename parameter but does not perform path traversal checks; the primary defect is absence of authentication rather than injection. No patch has been released as of the advisory publication date.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-27: disclosed: GitHub Security Advisory GHSA-crcx-7mx7-jqfr published
- 2026-09-11: advisory: CVE-2026-89250 and NVD entry published