Vulnerability · Published Sep 8, 2026 · Assigned by VulnCheck

CVE-2026-86727AVideo through 29.0 Information Disclosure via stats.json.php

High 7.5

In plain English

A high-severity missing authentication in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 55.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerate private, unlisted, and group-restricted live streams by parsing the hidden_applications array in the JSON response to obtain sensitive streaming credentials.

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	0 – through 29.0

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-8g4j-g3r6-73xr) vendor-advisory
VulnCheck Advisory: AVideo through 29.0 Information Disclosure via stats.json.php third-party-advisory