CVE-2026-88874: Exposure of Sensitive Information to an Unauthorized Actor in WWBN AVideo
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) does not enforce the Live stream password check on the stats endpoint or on the HLS origin. Live::_getStats() (plugin/Live/Live.php) returns a password-protected transmission's RTMP stream key, its isPasswordProtected flag, and its HLS (m3u8) URL to unauthenticated callers, in both the public applications list and the hidden_applications branch used when canSeeLiveFromLiveKey() fails. Separately, the shipped NGINX configuration (deploy/nginx/nginx.conf) serves the .m3u8 playlist, the AES-128 key, and the transport-stream segments from the /live location without any auth_request (the auth_key_check directive in the .key location is commented out). A remote, unauthenticated attacker can therefore retrieve the stream key and decryption key and watch a password-protected live transmission without supplying the configured password. No patched version was available at the time of the advisory.
AI Analysis
Technical Summary
CVE-2026-88874 describes a vulnerability in WWBN AVideo (revision c3edcc274c389816d434acadac07ee78eaf330c1) where the Live stream password check is not enforced on the stats endpoint or the HLS origin. The Live::_getStats() function returns sensitive information including the RTMP stream key, password protection flag, and HLS URL to unauthenticated callers. Additionally, the default NGINX configuration serves the .m3u8 playlist, AES-128 key, and transport-stream segments without authentication due to commented-out auth_key_check directives. This combination allows remote unauthenticated attackers to retrieve stream and decryption keys and watch password-protected live streams without supplying the password. No patched version was available at the time of publication.
Potential Impact
An unauthenticated remote attacker can obtain sensitive streaming credentials and decryption keys, enabling unauthorized viewing of password-protected live video streams. This compromises the confidentiality of live content intended to be restricted.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the stats endpoint and the /live location in NGINX configuration by implementing authentication or network-level controls to prevent unauthorized access.
CVE-2026-88874: Exposure of Sensitive Information to an Unauthorized Actor in WWBN AVideo
Description
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) does not enforce the Live stream password check on the stats endpoint or on the HLS origin. Live::_getStats() (plugin/Live/Live.php) returns a password-protected transmission's RTMP stream key, its isPasswordProtected flag, and its HLS (m3u8) URL to unauthenticated callers, in both the public applications list and the hidden_applications branch used when canSeeLiveFromLiveKey() fails. Separately, the shipped NGINX configuration (deploy/nginx/nginx.conf) serves the .m3u8 playlist, the AES-128 key, and the transport-stream segments from the /live location without any auth_request (the auth_key_check directive in the .key location is commented out). A remote, unauthenticated attacker can therefore retrieve the stream key and decryption key and watch a password-protected live transmission without supplying the configured password. No patched version was available at the time of the advisory.
CVSS v4.0
Score 8.7high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-88874 describes a vulnerability in WWBN AVideo (revision c3edcc274c389816d434acadac07ee78eaf330c1) where the Live stream password check is not enforced on the stats endpoint or the HLS origin. The Live::_getStats() function returns sensitive information including the RTMP stream key, password protection flag, and HLS URL to unauthenticated callers. Additionally, the default NGINX configuration serves the .m3u8 playlist, AES-128 key, and transport-stream segments without authentication due to commented-out auth_key_check directives. This combination allows remote unauthenticated attackers to retrieve stream and decryption keys and watch password-protected live streams without supplying the password. No patched version was available at the time of publication.
Potential Impact
An unauthenticated remote attacker can obtain sensitive streaming credentials and decryption keys, enabling unauthorized viewing of password-protected live video streams. This compromises the confidentiality of live content intended to be restricted.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the stats endpoint and the /live location in NGINX configuration by implementing authentication or network-level controls to prevent unauthorized access.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-10T11:24:26.196Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6aa2af40acd9273b492596dc
Added to database: 09/10/2026, 13:23:12 UTC
Last enriched: 09/10/2026, 14:07:15 UTC
Last updated: 09/10/2026, 17:00:16 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.