CVE-2026-91965

8.7 highEPSS 0.5%

High (8.7). EPSS 0.5% chance of exploitation in the next 30 days.

WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticated attackers can retrieve restricted live transmission details including stream keys, titles, descriptions, owner information, and direct HLS playback URLs by accessing these endpoints.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2026-09-15
Modified: 2026-09-16
Record from: the NVD, synced 2026-10-19

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-4xhp-wjpj-p92w
https://www.vulncheck.com/advisories/wwbn-avideo-through-29.0-broken-access-control-via-live-endpoints
https://github.com/WWBN/AVideo/security/advisories/GHSA-4xhp-wjpj-p92w

Check your stack JSON