GHSA-233c-vfmw-6rw9: WWBN AVideo through 29.7.1 Missing Authorization via Live Restream Endpoints

Published Nov 11, 2026

Updated

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows authenticated streamers to obtain other users' stream keys by supplying arbitrary livetransmitionshistoryid values. Attackers can redeem the issued action tokens at verifyTokenForAction.json.php to retrieve victims' HLS URLs and stream keys, then publish as the victim or restream private or pay-per-view lives.

Event History

Nov 11, 2026

CVE Published

via OSV·12:58 AM

Data Sourced

via OSV·12:58 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is realistically exposed to this issue?

Instances running WWBN AVideo through 29.7.1 with the Live plugin's restream functionality are exposed. Exploitation is available to authenticated users who can act as streamers; it does not require unauthenticated access or user interaction.

What does an attacker need to do to access another user's stream credentials?

The attacker supplies an arbitrary live_transmitions_history_id to the affected restream endpoints, obtains an action token, and redeems it through verifyTokenForAction.json.php. This can disclose the victim's HLS URL and stream key.

GHSA-233c-vfmw-6rw9: WWBN AVideo through 29.7.1 Missing Authorization via Live Restream Endpoints

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to do to access another user's stream credentials?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to do to access another user's stream credentials?