CVE-2026-40907 - Vulnerability Analysis

Overview

WWBN AVideo <= 29.0 contains an Insecure Direct Object Reference caused by improper access control in plugin/Live/view/Live_restreams/list.json.php, letting authenticated users with streaming permission access other users' live restream configurations including stream keys and OAuth tokens, exploit requires authenticated streaming permission.

Severity & Score

Impact

Authenticated users can access sensitive live stream keys and OAuth tokens, risking account compromise and unauthorized streaming.

Mitigation

Update to a version including commit d5992fff2811df4adad1d9fc7d0a5837b882aed7 or later.

References

• https://github.com/WWBN/AVideo/commit/d5992fff2811df4adad1d9fc7d0a5837b882aed7
• https://github.com/WWBN/AVideo/security/advisories/GHSA-gpgp-w4x2-h3h7

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner