CVE-2026-33716 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains an authentication bypass caused by user-controlled streamerURL parameter in plugin/Live/standAloneFiles/control.json.php, letting unauthenticated attackers control live streams by redirecting token verification, exploit requires no special privileges.

Severity & Score

Impact

Unauthenticated attackers can control live streams, including stopping streams and recordings, leading to full live stream management compromise.

Mitigation

Update to a version including commit 388fcd57dbd16f6cb3ebcdf1d08cf2b929941128 or later.

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-9hv9-gvwm-95f2
• https://github.com/WWBN/AVideo/commit/388fcd57dbd16f6cb3ebcdf1d08cf2b929941128

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner