CVE-2026-91965 — WWBN AVideo through 29.0 Broken Access Control via Live Endpoints
WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticated attackers can re…
Published: 2026-09-15 · CVSS: 8.7 · CVSS 4.0
WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticated attackers can retrieve restricted live transmission details including stream keys, titles, descriptions, owner information, and direct HLS playback URLs by accessing these endpoints.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7