CVE-2026-86728

8.7 highEPSS 0.6%

High (8.7). EPSS 0.6% chance of exploitation in the next 30 days.

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playlist IDs to retrieve sensitive credentials, server identifiers, and complete programme schedules without authentication.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2026-09-08
Modified: 2026-09-08
Record from: the NVD, synced 2026-10-19

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-xpr5-7246-qvh5
https://www.vulncheck.com/advisories/avideo-through-29.0-unauthenticated-disclosure-via-epg-json-php
https://github.com/WWBN/AVideo/security/advisories/GHSA-xpr5-7246-qvh5

Check your stack JSON