CVE-2026-40907 is an authorization bypass vulnerability categorized under CWE-639 (Authorization Bypass Through User-Controlled Key) affecting WWBN AVideo versions 29.0 and prior. The vulnerability exists in the plugin/Live/view/Live_restreams/list.json.php endpoint, where authenticated users with streaming permission can retrieve live restream configurations belonging to other users. This includes sensitive credentials such as third-party platform stream keys and OAuth tokens (access_token, refresh_token) for YouTube Live, Facebook Live, and Twitch. The issue is an Insecure Direct Object Reference (IDOR) that allows unauthorized data access. A specific commit has been identified as a fix, but no formal vendor advisory or patch link is provided. The CVSS 3.1 base score is 6.5, reflecting a medium severity impact primarily on confidentiality.

The vulnerability allows unauthorized disclosure of sensitive live streaming configuration data, including third-party platform stream keys and OAuth tokens. This exposure could lead to unauthorized use or hijacking of affected users' streaming accounts on platforms like YouTube Live, Facebook Live, and Twitch. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported at this time.

A code commit (d5992fff2811df4adad1d9fc7d0a5837b882aed7) fixes the vulnerability. However, no official vendor advisory or patch release information is provided. Users of WWBN AVideo version 29.0 or earlier should update to a version including this fix once available or apply the fix from the referenced commit. Since this is not a cloud service, remediation requires manual patching or upgrading by the user. Patch status is not yet confirmed — check the vendor advisory or official WWBN channels for current remediation guidance.