CVE-2026-86727: Missing Authentication for Critical Function in WWBN AVideo

CVE-2026-86727 is an information disclosure vulnerability affecting AVideo through version 29.0. The vulnerability exists in the plugin/Live/stats.json.php endpoint, which lacks authentication controls. This allows unauthenticated attackers to retrieve sensitive streaming credentials including stream keys and m3u8 URLs. The vulnerability enables enumeration of private, unlisted, and group-restricted live streams by parsing the hidden_applications array in the JSON response, exposing confidential streaming data.

An attacker can obtain sensitive streaming credentials without authentication, potentially compromising private and restricted live streams. This exposure could lead to unauthorized access or redistribution of live streaming content. The CVSS 4.0 score of 8.7 indicates a high severity impact with network attack vector, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin/Live/stats.json.php endpoint and monitor for unauthorized access attempts. Implement authentication controls on this endpoint to prevent unauthenticated information disclosure.