IDOR Vulnerability in WWBN AVideo Open Source Video Platform
CVE-2026-40907

6.5MEDIUM

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
21 April 2026

What is CVE-2026-40907?

AVideo, an open-source video platform developed by WWBN, presents a security flaw in its earlier versions (29.0 and prior). The vulnerability exists within the endpoint plugin/Live/view/Live_restreams/list.json.php, allowing authenticated users with streaming permissions to access other users' live restream configurations. This includes sensitive information such as third-party platform stream keys and OAuth tokens (including access_token and refresh_token) for major services like YouTube Live, Facebook Live, and Twitch. The issue has been addressed in commit d5992fff2811df4adad1d9fc7d0a5837b882aed7.

Affected Version(s)

AVideo <= 29.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-g...
x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/d5992fff2811df4adad...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.