CVE-2026-86726

AVideo, an open-source self-hosted live-streaming platform, contains an information-disclosure flaw in its restreamsActive.json.php endpoint, which returns active restream records without filtering them by user ownership. Any authenticated user with streaming privileges can call the endpoint and enumerate the source stream keys and identities behind every other streamer's currently active restreams. Because stream keys act as the credentials that authorize transmission into a channel, an attacker who obtains them can impersonate or take over restreams on the affected instance. All AVideo deployments through version 29.0 are affected, with the greatest impact on multi-streamer platforms (e.g., shared or community streaming sites) where keys and identities leak across all accounts. No public proof-of-concept or known exploitation exists; the flaw carries a low EPSS (0.3%, 18th percentile) and is not in CISA's KEV.

What to do: Upgrade AVideo to the latest vendor-patched release (newer than 29.0; no specific fixed version is provided in the available data). Until patched, restrict access to restreamsActive.json.php to trusted streamer accounts and rotate any stream keys that may have been exposed. Operators of single-streamer instances are minimally affected, while multi-streamer deployments should prioritize review and key rotation.