Executive brief
WWBN AVideo is a live streaming platform. Two endpoints that list live transmissions fail to check user group restrictions, allowing unauthenticated attackers to retrieve details about restricted streams including stream keys, titles, descriptions, and direct playback URLs. An attacker can bypass access controls that are normally enforced on the watch page and obtain sensitive stream credentials needed to intercept or manipulate live broadcasts.
Technical details
The vulnerability is a broken access control (CWE-200) in plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints, both of which are unauthenticated. While the application implements proper access control via LiveTransmition::userCanSeeTransmition() on watch pages and HLS playback endpoints, the JSON listing endpoints filter only on the public column (a display preference) and never invoke the ACL check. An attacker can send a network request to either endpoint to retrieve live transmissions that the user is explicitly denied access to, including the unmasked stream key, owner details, HLS playlist URL, and metadata. This occurs even when the application computes a masked key for display purposes but inadvertently includes the unmasked version in the JSON response. No authentication or user interaction is required. The vendor has not yet released a patched version.
Affected products
- WWBN AVideo through 29.0
Timeline
- 2026-08-31: disclosed: GitHub Security Advisory GHSA-4xhp-wjpj-p92w published
- 2026-09-15: advisory: CVE-2026-91965 published on NVD