CVE-2026-40907: WWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth Tokens
WWBN AVideo is an open source video platform. In versions 29.0 and prior, the endpoint plugin/Live/view/Liverestreams/list.json.php contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user with streaming permission to retrieve other users' live restream configurations, including third-party platform stream keys and OAuth tokens (accesstoken, refreshtoken) for services like YouTube Live, Facebook Live, and Twitch. Commit d5992fff2811df4adad1d9fc7d0a5837b882aed7 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability severity of CVE-2026-40907?
CVE-2026-40907 is classified as a high severity vulnerability due to its potential to expose sensitive user information.
How can I fix CVE-2026-40907?
To fix CVE-2026-40907, upgrade to a version of WWBN AVideo newer than 29.0, where the IDOR vulnerability is patched.
What type of vulnerability is CVE-2026-40907?
CVE-2026-40907 is an Insecure Direct Object Reference (IDOR) vulnerability that allows unauthorized access to other users' stream keys and OAuth tokens.
Which versions of WWBN AVideo are affected by CVE-2026-40907?
Versions of WWBN AVideo up to and including 29.0 are affected by CVE-2026-40907.
What data can be exposed due to CVE-2026-40907?
CVE-2026-40907 can expose other users' stream keys and OAuth tokens, compromising user privacy and security.