CVE-2026-91965: WWBN AVideo through 29.0 Broken Access Control via Live Endpoints
WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticated attackers can retrieve restricted live transmission details including stream keys, titles, descriptions, owner information, and direct HLS playback URLs by accessing these endpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WWBN AVideoto a version that resolves this vulnerability.Fixed in 29.0 - Configuration
Update plugin/Live/stats.json.php to enforce user-group restrictions so restricted live transmission details (including stream keys and live playback URLs) cannot be retrieved by unauthenticated/unauthorized users.
WWBN AVideo plugin/Live/stats.json.php user-group restriction enforcement = enforce user-group restrictions (block unauthorized access) - Configuration
Update plugin/Live/calendar.json.php to enforce user-group restrictions so restricted live transmission details cannot be retrieved by unauthenticated/unauthorized users.
WWBN AVideo plugin/Live/calendar.json.php user-group restriction enforcement = enforce user-group restrictions (block unauthorized access)
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can access the affected live endpoints. No credentials, user-group membership, or user interaction are required.
What information can be exposed?
The affected endpoints can disclose restricted live transmission details, including stream keys, titles, descriptions, owner information, and direct HLS playback URLs.
Which endpoints should be reviewed for exposure?
Review access to plugin/Live/stats.json.php and plugin/Live/calendar.json.php. These endpoints fail to enforce user-group restrictions in affected WWBN AVideo installations through version 29.0.
How can I determine whether my instance is affected?
Check whether an unauthenticated request to either affected endpoint returns details for live transmissions that should be restricted to particular user groups. Exposure of stream metadata, stream keys, owner details, or HLS URLs indicates the access-control failure is present.