CVE-2026-89250

WWBN AVideo, a self-hosted open-source video streaming platform, contains an unauthenticated file read (CWE-306) in the getRecordedFile.php endpoint, which serves recorded FLV files from the temporary directory. An attacker triggers the flaw by requesting that endpoint with a known or guessed stream key, and no authentication or authorization checks are performed on the request. Successful abuse allows the attacker to download recorded live-video files, including private recordings they were never authorized to view, without any credentials. Any AVideo deployment running code through commit c3edcc274c389816d434acadac07ee78eaf330c1 that exposes the endpoint to the network is affected. The issue is not in CISA's KEV and no public proof-of-concept or confirmed in-the-wild exploitation is known.

What to do: Upgrade AVideo to a release or commit newer than c3edcc274c389816d434acadac07ee78eaf330c1 once a fixed version is published (no fixed version is named in the advisory). Until patched, restrict or block unauthenticated access to getRecordedFile.php at the web server or WAF layer, and review access logs for unauthenticated requests to that endpoint containing stream keys, which would indicate recordings were downloaded.