Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-88874 – Authentication Bypass / Sensitive Data Exposure – WWBN AVideo (through commit c3edc

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-88874 is an authentication bypass / sensitive information exposure vulnerability (CWE-200) in WWBN’s AVideo open-source video streaming platform. It allows unauthenticated attackers to obtain stream keys, HLS playlist URLs, AES-128 encryption keys, and media segments for live streams that are configured as password-protected, effectively defeating the platform’s live-stream access controls. The issue affects the AVideo master branch through commit c3edcc274c389816d434acadac07ee78eaf330c1 (August 23, 2026) and carries a CVSS score of 8.7 (High).

Technical details

  • Root cause: Two related flaws combine to bypass live-stream password protection: (1) the Live::_getStats() function returns sensitive stream data — including the RTMP stream key, the HLS .m3u8 URL returned by Live::getM3U8File(), and an isPasswordProtected flag — to callers without verifying authentication; (2) AVideo’s shipped NGINX configuration serves HLS playlists, AES-128 encryption keys, and media segments from the /live location without an auth_request directive, relying on path secrecy rather than enforced authorization.
  • Trigger conditions: A live stream must be configured with password protection enabled. The normal watch page enforces password verification via Live::checkIfPasswordIsGood(), but this check is not applied to the stats endpoint or to direct HLS resource requests.
  • Attack vector: Network — no authentication or user interaction is required. An attacker queries the stats endpoint to retrieve the stream key and playlist URL, then fetches the M3U8 playlist, encryption key, and media segments directly from the unauthenticated NGINX /live path.
  • Impact: Full disclosure of live-stream content and stream credentials to unauthorized parties, bypassing intended password protection. Confidentiality impact is high; integrity and availability are not affected.

Affected software

  • WWBN AVideo — all versions/builds through git commit c3edcc274c389816d434acadac07ee78eaf330c1 on the master branch (as of August 23, 2026)

Severity

  • CVSS v4.0: 8.7 (High) — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
  • CVSS v3.1: 7.5 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Mitigation and recommended actions

  • Immediate: As of publication, no patched AVideo release is available. Track the WWBN/AVideo repository and GitHub Security Advisory GHSA-7h6j-2gh9-h9rw for a fix and upgrade as soon as one is released.
  • Workarounds/network mitigations (no patch available):
    • Add an auth_request (or equivalent authorization check tied to the AVideo session/password state) to the NGINX /live location so HLS playlists, encryption keys, and media segments cannot be fetched by path alone.
    • Restrict or disable public access to the stats endpoint used by Live::_getStats(), or front it with authentication enforcement consistent with the main watch page.
    • Where feasible, restrict access to live-streaming endpoints to trusted networks/VPN until a vendor patch is released.
    • Rotate any live-stream keys and encryption keys that may have been exposed while the vulnerable configuration was in use.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge