Authentication Bypass in AVideo by WWBN

CVE-2026-88874

What is CVE-2026-88874?

AVideo has a security flaw where the Live stream password check is not enforced on the stats endpoint or the HLS origin. The Live::_getStats() method exposes password-protected stream keys and URLs to unauthenticated users. This vulnerability allows remote attackers to access protected streams without needing the password since critical security directives in the NGINX configuration are commented out. As a consequence, attackers can retrieve sensitive information such as the stream key and decryption key, enabling unauthorized viewing of live broadcasts.

References