CVE-2026-86726: Insufficiently Protected Credentials in WWBN AVideo

AVideo through version 29.0 contains an information disclosure vulnerability in the restreamsActive.json.php endpoint. This endpoint fails to filter results by user ownership, allowing any authenticated streamer to enumerate the source stream keys and identities of all other streamers' active restreams. This results in exposure of sensitive transmission credentials and streamer identity information across all accounts to any user with streaming capability.

The vulnerability allows authenticated users with streaming privileges to access sensitive information including source stream keys and identities of other streamers. This could lead to unauthorized use or hijacking of streaming sessions, compromising confidentiality and potentially integrity of streaming content. There is no indication of privilege escalation or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict streaming capability to trusted users only and monitor for suspicious activity related to restreams. Avoid sharing streaming credentials and consider additional access controls around the restreamsActive.json.php endpoint.