High severity7.5NVD Advisory· Published Sep 15, 2026· Updated Sep 16, 2026

CVE-2026-91965

Description

WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticated attackers can retrieve restricted live transmission details including stream keys, titles, descriptions, owner information, and direct HLS playback URLs by accessing these endpoints.

Affected products

WWBN/Avideollm-fuzzy
Range: <=29.0

Patches

Vulnerability mechanics

References

github.com/WWBN/AVideo/security/advisories/GHSA-4xhp-wjpj-p92wnvd
www.vulncheck.com/advisories/wwbn-avideo-through-29.0-broken-access-control-via-live-endpointsnvd

News mentions

WWBN AVideo: Twelve Vulnerabilities Disclosed, Including Auth Bypass and SSRF
Vypr Intelligence · Sep 16, 2026
WWBN AVideo: Three SSRF and Info Disclosure Flaws Disclosed Together
Vypr Intelligence · Sep 15, 2026

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000