CVE-2026-126541: WWBN AVideo through 29.7.1 Missing Authorization via Live Restream Endpoints
WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows authenticated streamers to obtain other users' stream keys by supplying arbitrary livetransmitionshistoryid values. Attackers can redeem the issued action tokens at verifyTokenForAction.json.php to retrieve victims' HLS URLs and stream keys, then publish as the victim or restream private or pay-per-view lives.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be an authenticated AVideo user with streamer access. They can target other users by supplying arbitrary live_transmitions_history_id values to the affected Live plugin restream endpoints.
What can an attacker do with a recovered stream key?
The attacker can redeem an issued action token to retrieve a victim's HLS URL and stream key. This can allow publishing as the victim or restreaming private or pay-per-view live streams.
Which versions are known to be affected?
WWBN AVideo through version 29.7.1 is affected. The provided data does not identify a fixed version.
How can I determine whether an instance is vulnerable?
Review the Live plugin restream handling, including getRestream.json.php and action-token verification at verifyTokenForAction.json.php. An instance is affected if an authenticated streamer can request a restream action using another user's live_transmitions_history_id and obtain a token that reveals that user's HLS URL or stream key.