CVE-2026-86727 — AVideo through 29.0 Information Disclosure via stats.json.php
AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by…
Published: 2026-09-08 · CVSS: 8.7 · CVSS 4.0
AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerate private, unlisted, and group-restricted live streams by parsing the hidden_applications array in the JSON response to obtain sensitive streaming credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7