Authentication Bypass in AVideo Exposing Sensitive Data

CVE-2026-86728

What is CVE-2026-86728?

A security flaw in AVideo versions up to 29.0 allows unauthorized users to bypass authentication and access sensitive information through the epg.json.php endpoint. This vulnerability enables attackers to sequentially query user or playlist IDs, potentially exposing live-stream keys and private electronic program guide (EPG) schedules. As a result, critical server identifiers and complete program schedules can be retrieved without proper authentication measures in place, posing a significant risk to user privacy and content security.

References