CVE-2026-86728 describes an authentication bypass vulnerability in WWBN AVideo through version 29.0. The vulnerability exists in the plugin/PlayLists/epg.json.php endpoint, which does not properly enforce authentication. Attackers can enumerate sequential user or playlist IDs to retrieve sensitive information including live-stream keys, private EPG schedules, server identifiers, and credentials without any authentication. This exposure compromises the confidentiality of streaming keys and program schedules.

The vulnerability allows unauthenticated attackers to access sensitive live-stream keys and private program schedules, potentially enabling unauthorized access to streaming content and exposure of confidential scheduling information. This can lead to unauthorized content viewing or service disruption. The CVSS 4.0 base score is 8.7, indicating a high severity impact with network attack vector, no required privileges or user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Until a patch is available, restrict access to the vulnerable endpoint and monitor for suspicious requests targeting plugin/PlayLists/epg.json.php. Implement access controls or authentication enforcement on this endpoint if possible.