WWBN AVideo: Twelve Auth/Authz Bypass Vulnerabilities Disclosed Together
Key findings • Twelve vulnerabilities disclosed for WWBN AVideo on September 8, 2026, impacting authentication and authorization. • High-severity flaws include authentication bypass via loose…
Key findings
- Twelve vulnerabilities disclosed for WWBN AVideo on September 8, 2026, impacting authentication and authorization.
- High-severity flaws include authentication bypass via loose comparison and cached results (CVE-2026-86723, CVE-2026-86722).
- Information disclosure vulnerabilities expose stream keys and user credentials through various endpoints.
- Cross-site request forgery (CSRF) vulnerabilities affect multiple plugins, allowing unauthorized actions.
- Some vulnerabilities affect specific commits and versions up to 29.0; no patch is available for CVE-2026-86729.
On September 8, 2026, a batch of twelve vulnerabilities was disclosed for WWBN's AVideo platform, with several high-severity flaws impacting authentication and authorization mechanisms. These vulnerabilities, all disclosed on the same day, expose sensitive information such as stream keys and user credentials, and allow for unauthorized actions.
Several vulnerabilities center on authentication bypass. CVE-2026-86723 and CVE-2026-86722, both rated High with CVSSv3 scores of 8.1, exploit weaknesses in AVideo's authentication logic. CVE-2026-86723 leverages loose comparison in LoginControl::verifyChallenge(), allowing attackers with just a password to bypass authentication. CVE-2026-86722 involves cached empty result sets that can bypass two-factor authentication. Additionally, CVE-2026-86728 (High, 7.5) and CVE-2026-86727 (High, 7.5) in epg.json.php and stats.json.php respectively, allow unauthenticated access to live stream keys and private EPG schedules. CVE-2026-86729 (High, 7.4) exposes an undocumented login path in get_api_preauthorize.php without rate limiting.
Authorization bypass is another significant theme. CVE-2026-86721 (High, 7.5) allows attackers to publish to any user's RTMP stream by exploiting a session cookie override in saveLive.php. CVE-2026-86720 (High, 8.1) in resendRestreamer.json.php allows authenticated users to access other users' restream destinations due to a failure to validate ownership of live_restreams_id. The SocialMediaPublisher plugin is affected by CVE-2026-86725 (High, 7.1), where authenticated users can modify other users' OAuth token records by supplying arbitrary row IDs.
Information disclosure vulnerabilities are also present. CVE-2026-86726 (Medium, 6.5) in restreamsActive.json.php allows authenticated streamers to enumerate the source stream keys and identities of other active streamers.
Cross-site request forgery (CSRF) vulnerabilities were identified in several plugins. CVE-2026-86724 (Medium, 6.5) in the YPTWallet plugin's saveBalance.php allows attackers to set arbitrary wallet balances. CVE-2026-86719 (Medium, 5.4) in the CustomizeUser plugin's swapUser.json.php allows for user swapping without proper validation. CVE-2026-86718 (High, 7.1) affects deleteHistory.json.php and finishAll.json.php, allowing unauthenticated attackers to mutate live history.
The vulnerabilities affect AVideo through specific commits, including e01e41ecc and c3edcc274c389816d434acadac07ee78eaf330c1, and versions up to 29.0. Notably, for CVE-2026-86729, no patched version is currently available. Users are advised to review the specific commits and versions mentioned in the advisories to understand their exposure and apply available patches.
This batch of vulnerabilities highlights critical weaknesses in AVideo's security posture, particularly concerning authentication and authorization. Users should prioritize patching and reviewing their configurations to mitigate the risks associated with these disclosures. The lack of a patch for CVE-2026-86729 is a significant concern, requiring users to seek alternative mitigation strategies if possible.