WWBN AVideo contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint, which streams recorded FLV files from a temporary directory. Attackers can exploit this by requesting the endpoint with a known or guessed stream key, bypassing any authentication or authorization checks to download recorded live video files. The vulnerability is identified in version 0 of the product and has a CVSS 4.0 base score of 8.7, indicating high severity due to network attack vector, no required privileges or user interaction, and high impact on confidentiality.

An attacker can download recorded live video files without any authentication or authorization, potentially exposing sensitive or private video content. This compromises confidentiality of recorded streams and may lead to privacy violations or unauthorized data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the getRecordedFile.php endpoint and ensure stream keys are sufficiently complex and kept confidential. Monitor for any updates from WWBN regarding an official fix.