CVE-2026-86727

AVideo through version 29.0 is affected by a missing-authentication information disclosure (CWE-306) in plugin/Live/stats.json.php, where the endpoint returns sensitive streaming data without requiring any authentication. An unauthenticated attacker can simply request this endpoint over the network and receive stream keys and m3u8 URLs in the JSON response. By parsing the hidden_applications array in that response, the attacker can enumerate live streams that are configured as private, unlisted, or restricted to groups, and use the leaked credentials or URLs to view or take over access to those streams. Any deployment of AVideo up to and including 29.0 with this endpoint reachable (typically internet-exposed self-hosted streaming servers) is affected. Exploitation is not currently known: there is no public proof of concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at roughly 0.3%.

What to do: As an interim mitigation, restrict unauthenticated access to plugin/Live/stats.json.php (for example with web-server access rules or authentication at the reverse proxy) and check whether your instance's response includes hidden_applications with stream keys. Rotate any stream keys that could have been disclosed, since unauthenticated reads may have occurred before the flaw was published. Upgrade to an AVideo release newer than 29.0 once the vendor publishes a fixed version, and monitor the project's advisories for the patched release number.