Vulnerability · Published Sep 8, 2026 · Assigned by VulnCheck
CVE-2026-86728AVideo through 29.0 Unauthenticated Disclosure via epg.json.php
High 7.5
In plain English
A high-severity missing authentication in AVideo from WWBN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 53.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playlist IDs to retrieve sensitive credentials, server identifiers, and complete programme schedules without authentication.
Affected products (as reported)
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- GitHub Security Advisory (GHSA-xpr5-7246-qvh5) vendor-advisory
- VulnCheck Advisory: AVideo through 29.0 Unauthenticated Disclosure via epg.json.php third-party-advisory