High severity7.5NVD Advisory· Published Sep 8, 2026

CVE-2026-86727

Description

AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerate private, unlisted, and group-restricted live streams by parsing the hidden_applications array in the JSON response to obtain sensitive streaming credentials.

Affected products

WWBN/Avideollm-fuzzy
Range: <=29.0

Patches

Vulnerability mechanics

References

github.com/WWBN/AVideo/security/advisories/GHSA-8g4j-g3r6-73xrnvd
www.vulncheck.com/advisories/avideo-through-29.0-information-disclosure-via-stats-json-phpnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000