high7.5
CVE-2026-91965
WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints.
Impact
WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticated attackers can retrieve restricted live transmission details including stream keys, titles, descriptions, owner information, and direct HLS playback URLs by accessing these endpoints.
Affected products
| Product | Affected versions |
|---|---|
| WWBN AVideo | through 29.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.