Wwbn Avideo
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Wwbn Avideo.
By the Year
In 2026 there have been 215 vulnerabilities in Wwbn Avideo with an average score of 7.0 out of ten. Last year, in 2025 Avideo had 16 security vulnerabilities published. That is, 199 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 1.91
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 215 | 6.97 |
| 2025 | 16 | 8.89 |
| 2024 | 16 | 7.56 |
| 2023 | 5 | 7.78 |
| 2022 | 24 | 7.56 |
| 2021 | 1 | 8.80 |
| 2020 | 2 | 8.15 |
It may take a day or so for new Avideo vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Wwbn Avideo Security Vulnerabilities
WWBN AVideo API BruteForce via Undocumented get_api_preauthorize Endpoint
CVE-2026-86729
9.1 - Critical
- September 08, 2026
WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in plugin/API/API.php as a second, undocumented login path. Unlike get_api_signIn, which enforces a rate limit of 10 attempts per 5 minutes via checkRateLimit(), get_api_preauthorize performs the same credential check with no throttling for any client, allowing unlimited remote password guessing against arbitrary accounts, including admin. The endpoint also acts as a credential oracle: it returns the message "Invalid credentials" for both correct and incorrect passwords, while the users_id field in the response body discloses the authenticated identity (users_id:1 on success, users_id:0 on failure), and a correct password establishes a session cookie that remains usable for authenticated API requests. Together these issues permit unauthenticated brute-force account takeover.
Improper Restriction of Excessive Authentication Attempts
Auth Bypass AVideo <=29.0 via epg.json.php exposing stream keys
CVE-2026-86728
8.7 - High
- September 08, 2026
AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playlist IDs to retrieve sensitive credentials, server identifiers, and complete programme schedules without authentication.
Missing Authentication for Critical Function
AVideo 29.0 Info Disclosure: Unauth Live Stream Keys via stats.json.php
CVE-2026-86727
8.7 - High
- September 08, 2026
AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerate private, unlisted, and group-restricted live streams by parsing the hidden_applications array in the JSON response to obtain sensitive streaming credentials.
Missing Authentication for Critical Function
AVideo <=29.0 Info Disclosure via restreamsActive.json.php
CVE-2026-86726
7.1 - High
- September 08, 2026
AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticated streamers to enumerate source stream keys and identities of all other streamers' active restreams. The endpoint fails to filter results by user ownership, exposing sensitive transmission credentials and streamer identity across all accounts to any user with streaming capability.
Insufficiently Protected Credentials
AVideo SocialMediaPublisher add.json.php Auth Bypass
CVE-2026-86725
7.1 - High
- September 08, 2026
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that allows authenticated users to modify other users' OAuth token records. Attackers can supply arbitrary row IDs to overwrite another user's stored access_token and refresh_token, then delete the compromised record to destroy the victim's provider linkage.
Insecure Direct Object Reference / IDOR
AVideo CSRF: YPTWallet saveBalance.php allows arbitrary wallet balance changes
CVE-2026-86724
7.1 - High
- September 08, 2026
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a malicious webpage that, when loaded by an administrator, submits a POST request to modify any user's wallet balance to any value.
Session Riding
AVideo Auth Bypass via Loose == in LoginControl::verifyChallenge
CVE-2026-86723
8.6 - High
- September 08, 2026
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability in LoginControl::verifyChallenge() that uses loose comparison (==) instead of strict comparison (===) against unset session values. Attackers with only a password can submit an empty request to verifyChallenge.json.php to bypass PGP two-factor authentication and gain full authenticated access.
authentification
AVideo Auth Bypass via SQL Cache & 2FA Flaw
CVE-2026-86722
8.6 - High
- September 08, 2026
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates. Attackers with a valid password can bypass email two-factor authentication on new devices because the confirmation code hash fails to generate from the stale cached empty result.
authentification
AVideo Auth Bypass via Session Cookie 'key' in Live Streams
CVE-2026-86721
8.7 - High
- September 08, 2026
AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $_REQUEST['key'] parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the known constant stream key value to hijack live broadcasts.
authentification
AVideo: Authenticated Hijack via live_restreams_id
CVE-2026-86720
8.6 - High
- September 08, 2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of live_restreams_id in resendRestreamer.json.php, allowing authenticated users with canStream to access other users' restream destinations. Attackers can broadcast their live stream to victim-configured restream destinations by supplying arbitrary live_restreams_id values, hijacking YouTube, Facebook, or Twitch streams using victim stream keys.
Insecure Direct Object Reference / IDOR
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master) contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php
CVE-2026-86719
5.3 - Medium
- September 08, 2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master) contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint takes users_id from $_REQUEST and invokes User::swapUser() without calling forbidIfNotPost() or forbidIfInvalidToken(), and the global autoCSRFGuard() check only runs for POST requests to *.json.php, so the action is reachable via GET. An attacker who causes an authenticated administrator's browser to issue a cross-origin GET (for example via an <img> tag or link) can replace that administrator's session with a non-admin user account, causing the administrator to lose administrative access until the swap is cancelled; swapping to another administrator account is rejected, so this is not privilege escalation. The JSON response also discloses the session_id. The CustomizeUser plugin is enabled by default, and no patch was available at the time of publication.
Session Riding
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll.json.php
CVE-2026-86718
7.1 - High
- September 08, 2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll.json.php that allows unauthenticated attackers to mutate live history by making GET requests without CSRF token validation. Attackers can craft malicious pages that trigger administrator browsers to delete all live transmission history or mark streams as finished when an admin visits the attacker-controlled site.
Session Riding
WWBN AVideo Broken Access Control Exposes User Records & Session IDs
CVE-2026-86190
9.3 - Critical
- September 05, 2026
WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session identifier to hijack viewer sessions, including administrator accounts, and obtain sensitive personal data for all video viewers.
Information Disclosure
AVideo Path Traversal Exploit via notify.ffmpeg.json.php
CVE-2026-86189
9.3 - Critical
- September 05, 2026
WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories.
External Control of File Name or Path
AVideo YPTSocket XSS via WebSocket Callback
CVE-2026-86188
6.9 - Medium
- September 05, 2026
AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global functions like avideoConfirmHTML that accept untrusted data and assign it to innerHTML, achieving script execution in the victim's origin without authentication or user interaction.
XSS
AVideo External Login CVE-2026-86187: 31-bit Rand MD5 Weakness
CVE-2026-86187
7.4 - High
- September 05, 2026
WWBN AVideo generates passwords for external-login accounts using rand() instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing.
Use of Insufficiently Random Values
AVideo API RateLimit Bypass via Bot UA
CVE-2026-86186
6.3 - Medium
- September 05, 2026
AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited password guessing attempts against any account from a single IP address.
Improper Restriction of Excessive Authentication Attempts
AVideo Reflected XSS in userLogin.php via error param
CVE-2026-85577
5.3 - Medium
- September 04, 2026
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with </script>. Attackers can craft a malicious URL with an error parameter containing script breakout sequences to execute arbitrary JavaScript in the victim's browser context on the login page.
XSS
AVideo SSRF via set_api_userImages profileImg/backgroundImg URLs
CVE-2026-85164
7.1 - High
- September 03, 2026
WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the set_api_userImages API endpoint that fails to validate profileImg and backgroundImg URLs before fetching them. Authenticated API clients can supply internal URLs to fetch cloud metadata or internal services, with responses written to publicly accessible web paths for retrieval.
SSRF
SSRF in AVideo EPG Parser (commit c91b5975d)
CVE-2026-85163
7.1 - High
- September 03, 2026
AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary internal URLs. An attacker can supply an internal URL via the epg_link parameter during video upload, which is validated only for syntax and later fetched server-side during EPG generation without SSRF protection checks.
SSRF
AVideo CSRF in Live/saveLive.php Enables RTMP Key Hijack
CVE-2026-85162
7.1 - High
- September 03, 2026
AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacking live broadcasts.
Session Riding
AVideo removePoster.php CSRF via GET (CVE-2026-85161)
CVE-2026-85161
5.3 - Medium
- September 03, 2026
AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken checks. Attackers can craft malicious image tags to delete authenticated victims' live poster and thumbnail files via GET requests.
Session Riding
AVideo CSRF+PathTrv traversal in stopLive.php triggers recursive delete
CVE-2026-85160
7.2 - High
- September 03, 2026
AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal payload like key=../../videos to trigger recursive deletion of the videos directory when an admin visits a malicious page.
External Control of File Name or Path
AVideo Reflected XSS via cancelUri in userLogin.php
CVE-2026-85159
5.3 - Medium
- September 03, 2026
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative URLs with embedded quotes to execute arbitrary JavaScript when users interact with the Cancel button.
XSS
AVideo Reflected XSS via Comment Injection in videoEmbeded.php
CVE-2026-85158
5.3 - Medium
- September 03, 2026
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with --> and inject arbitrary JavaScript that executes when victims visit the crafted embed URL.
XSS
AVideo ACL Bypass via feed/index.php RSS Feed
CVE-2026-85157
6.9 - Medium
- September 03, 2026
WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a program_id parameter is supplied. Attackers can enumerate playlist identifiers and retrieve unlisted and group-restricted videos by requesting the RSS feed with any visible playlist id, including empty playlists that return the entire site's hidden video catalogue.
Information Disclosure
AVideo Public Channel Access Bypass (Unauthenticated Access to Restricted Videos)
CVE-2026-85156
6.9 - Medium
- September 03, 2026
WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through hardcoded visibility flags and an undefined property. Attackers can access the channel endpoint to retrieve sensitive video content that should be hidden, including full URLs to unlisted videos and thumbnails of member-only content, regardless of the operator's hidePrivateVideos setting.
Information Disclosure
AVideo SQLi via get.json.php sort param (unauth)
CVE-2026-85155
8.7 - High
- September 03, 2026
WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this ordering oracle to infer password hash values and recovery tokens, and trigger SQL errors that disclose the full query statement and database schema.
SQL Injection
AVideo Auth Token Replay via video_id_hash Credential
CVE-2026-85154
9.3 - Critical
- September 03, 2026
WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a video_id_hash can replay it indefinitely to authenticate as the video owner with full privileges, and the credential remains valid even after the owner changes their password.
Improper Privilege Management
AVideo HMAC Auth Bypass via encryptPass.json.php
CVE-2026-84483
6.9 - Medium
- September 01, 2026
WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using the public site URL and current time. Attackers can forge authentication tokens by computing hash_hmac with the site's base URL as the key and submit arbitrary passwords to receive encrypted hashes, enabling offline precomputation attacks against stolen password databases.
Use of Hard-coded Cryptographic Key
AVideo XSRF in get_domain()/isSameDomain() allows admin config changes
CVE-2026-84482
8.7 - High
- September 01, 2026
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDomain() functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative ObjectYPT writes including live server configuration changes.
Origin Validation Error
AVideo PHP Perm Exp Token Reset Bypass
CVE-2026-84480
9.3 - Critical
- September 01, 2026
WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full account access.
Insufficient Session Expiration
AVideo 30.0 MobileManager Plugin Info Disclosure via getConfiguration
CVE-2026-84481
6.9 - Medium
- September 01, 2026
WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data to unauthenticated visitors. Attackers can send an unauthenticated GET request to plugin/MobileManager/getConfiguration.json.php to obtain TLS private key file paths, socket configuration details, platform version, and debug flags enabling further targeted attacks.
Information Disclosure
AVideo User-Agent Bypass of 2FA & Captcha (CVE-2026-84479)
CVE-2026-84479
9.3 - Critical
- September 01, 2026
WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder()/isAVideoMobileApp() checks match HTTP_USER_AGENT against a hardcoded literal ("AVideoEncoder"/"AVideoMobileApp") with no IP check or shared secret. An attacker who submits valid credentials and sets User-Agent: AVideoEncoder bypasses two-factor authentication, skips brute-force captcha escalation, and avoids being recorded in the login/device audit history. No patch is available at the time of publication.
Authentication Bypass by Spoofing
AVideo Path Traversal: Unauth File Delete via get_api_login_code
CVE-2026-84478
6.9 - Medium
- September 01, 2026
WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated attackers to delete arbitrary .log files by supplying directory traversal sequences in the code parameter. Attackers can exploit this to destroy audit logs and probe for file existence on the server, with the vulnerability enabling both file deletion and information disclosure about the filesystem.
External Control of File Name or Path
Stored XSS in AVideo Live_schedule via remindMe.php
CVE-2026-84477
5.1 - Medium
- September 01, 2026
AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication.
XSS
AVideo X-Real-IP Header Spoofing Bypass Rate Limiting
CVE-2026-84476
8.7 - High
- September 01, 2026
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit(). Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing attacks.
Authentication Bypass by Spoofing
AVideo <=29.0: Unauth SQLi via User_Location plugin regions.json/cities.json
CVE-2026-84208
8.7 - High
- September 01, 2026
AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed directly into SQL queries without escaping or prepared statement binding, allowing unauthenticated attackers to execute UNION-based SQL injection to read arbitrary database contents including password hashes and sensitive data.
SQL Injection
AVideo: Unauth Publish Endpoint Enables Cancel Scheduled Broadcasts
CVE-2026-84187
8.8 - High
- September 01, 2026
AVideo contains a missing authentication vulnerability in plugin/Live/on_publish.php that allows unauthenticated attackers to mark arbitrary scheduled broadcasts as failed by sending crafted POST requests with schedule identifiers. Attackers can exploit the unguarded RTMP callback endpoint to modify scheduled broadcast status fields by supplying fabricated stream keys matching the pattern -ps-<N>, silently canceling any scheduled live broadcast without credentials or authorization.
Authorization
AVideo CSRF in API set.json.php enables unauthenticated state changes
CVE-2026-83595
7.2 - High
- September 01, 2026
AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypass CSRF protection. Attackers can navigate a victim's browser to a malicious URL with API parameters to delete videos, deactivate accounts, or modify playlists without user interaction.
Session Riding
AVideo SSRF Filter Bypass via Hex-Encoded NAT64 Addresses
CVE-2026-82648
7.1 - High
- August 30, 2026
WWBN AVideo contains a server-side request forgery filter bypass vulnerability in the isSSRFSafeURL function that fails to normalize NAT64 addresses written in hexadecimal form. Attackers can bypass SSRF protections by supplying hex-encoded NAT64 addresses like 64:ff9b::a9fe:a9fe to reach cloud metadata services and loopback interfaces.
Improper Input Validation
AVideo CSRF in sendEmail.json.php Enables Admin Email Abuse
CVE-2026-82647
5.3 - Medium
- August 30, 2026
WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's contact address by bypassing origin checks and captcha validation. Attackers can craft a malicious web page that, when visited by an authenticated admin, sends emails with attacker-controlled subject and body to arbitrary recipients, passing SPF/DKIM/DMARC validation for phishing and brand impersonation attacks.
Session Riding
AVideo Reflected XSS via url2Embed.json.php Endpoint
CVE-2026-82646
5.3 - Medium
- August 30, 2026
WWBN AVideo contains an unauthenticated reflected cross-site scripting vulnerability in the url2Embed.json.php endpoint that allows attackers to inject malicious scripts by supplying URLs with HTML metacharacters. Attackers can mint an encrypted evideo payload containing unescaped markup, then deliver it as a legitimate-looking link on the site's own domain to execute JavaScript in victims' sessions and steal cookies or CSRF tokens.
XSS
AVideo Live Restream Credential Leak via Unsanitized Token
CVE-2026-82645
9.2 - Critical
- August 30, 2026
AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live/view/Live_restreams/getLiveKey.json.php endpoint. Supplying a 'token' request parameter waives both the Live::canRestream() access gate and the restream ownership check, causing the endpoint to return any restream's stream_key and stream_url (credentials for external platforms such as YouTube, Facebook, and Twitch) without authentication. The token is merely encryptString() of an integer id with no user binding, expiry, or authentication tag. Because encryption uses AES-256-CBC with a deterministic IV and no MAC, and because intval() accepts any string beginning with a digit, an unauthenticated attacker can forge valid tokens using the public encryption oracle in view/url2Embed.json.php, disclosing arbitrary users' stream credentials.
Improper Verification of Cryptographic Signature
AVideo BruteForce RateLimit Bypass via Bot Detection
CVE-2026-82644
8.7 - High
- August 30, 2026
WWBN AVideo (current e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRateLimit(), which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer (ObjectYPT::setCacheGlobal) that silently discards writes for any client identified as a bot by isBot(). Because isBot() treats a missing User-Agent header as a bot by default and also matches common bot identifiers such as 'curl', 'bot', 'crawler', and 'spider' the counter never increments for such clients, so the rate limit never fires. An unauthenticated attacker can therefore submit unlimited login attempts (e.g., by omitting the User-Agent header or using curl's default User-Agent), enabling unrestricted password-guessing attacks.
Improper Restriction of Excessive Authentication Attempts
AVideo Unauth Credential Submit via GET in Live API
CVE-2026-82643
6.9 - Medium
- August 30, 2026
WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustained password guessing attacks against user accounts.
Improper Restriction of Excessive Authentication Attempts
AVideo <=30.0: report4.json.php Unauth Access to User Stats
CVE-2026-81732
6.9 - Medium
- August 28, 2026
WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to user registration statistics. Attackers can send GET requests to these endpoints to retrieve daily and cumulative user-registration counts without any session or authorization.
Information Disclosure
AVideo CSRF in Live plugin myLiveControls.save.json.php (v30.0)
CVE-2026-81733
5.1 - Medium
- August 28, 2026
WWBN AVideo through 30.0 (and master up to commit 4cb576e) contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $_REQUEST via a GET request without enforcing a CSRF token or origin check. An attacker who lures a logged-in streamer to a malicious page can silently change the live-channel viewer-redirect settings (persisted in users.externalOptions), causing viewers to be redirected to a phishing site or shown a spoofed message.
Session Riding
AVideo SSRF Vulnerability via LiveLinks (pre-24.0)
CVE-2026-81678
6.9 - Medium
- August 27, 2026
AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can bypass SSRF protections via the LiveLinks proxy endpoint to reach internal services and cloud metadata endpoints by encoding private IPv4 targets in transition address formats.
SSRF
AVideo Auth Bypass via deduplicateByEncoderQueueId & video_id_hash
CVE-2026-59808
8.7 - High
- August 22, 2026
AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId() returns video_id_hash credentials for any video by encoder_queue_id without ownership verification, and useVideoHashOrLogin() converts this hash into passwordless login as the video owner. Attackers with upload permission can retrieve an administrator's video_id_hash by omitting the videos_id parameter, then use that hash in an unauthenticated request to gain administrative session access and modify system configuration.
Missing Authentication for Critical Function
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Wwbn Avideo or by Wwbn? Click the Watch button to subscribe.
