CVE-2026-86727: AVideo through 29.0 Information Disclosure via stats.json.php
AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerate private, unlisted, and group-restricted live streams by parsing the hiddenapplications array in the JSON response to obtain sensitive streaming credentials.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
AVideo instances through version 29.0 that expose plugin/Live/stats.json.php are affected. The endpoint can disclose data for private, unlisted, and group-restricted live streams.
What does an attacker need to exploit it?
An attacker needs only network access to the affected endpoint. No authentication, privileges, or user interaction are required.
What information can be obtained?
The JSON response can expose stream keys and m3u8 URLs. An attacker can parse the hidden_applications array to enumerate streaming credentials for restricted live streams.