CVE-2026-86728

AVideo, a self-hosted video streaming platform, contains a missing-authentication flaw (CWE-306) in plugin/PlayLists/epg.json.php, present in all versions through 29.0. An unauthenticated remote attacker can send crafted requests to this endpoint, enumerating sequential user or playlist IDs to bypass authentication entirely. Successful requests return sensitive material including live-stream keys, credentials, server identifiers, and complete private EPG (electronic programme guide) schedules; the flaw scores 8.7 High on CVSS 4.0 with high confidentiality impact only. Any deployment running AVideo through 29.0 with the PlayLists EPG endpoint reachable is affected, particularly instances hosting live streams with protected schedules. There is currently no known public proof-of-concept, no listing in CISA's KEV catalog, and a low EPSS of 0.3%, indicating no confirmed exploitation activity yet.

What to do: Upgrade AVideo to a version newer than 29.0 once a patched release is available (a specific fixed version is not stated in the available disclosure data). As an interim mitigation, restrict access to /plugin/PlayLists/epg.json.php to authenticated users via a reverse proxy or web server rule, and review access logs for unauthenticated requests to that path. If exposure is confirmed, rotate any live-stream keys and credentials that the endpoint could have leaked.