{"id":"CVE-2026-86727","title":"AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication","summary":"AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers ca…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-306"],"vendor":"WWBN","product":"AVideo","affected":["AVideo <= 29.0"],"published":"2026-09-08","updated":"2026-09-10","sourceUpdated":"2026-09-10T14:17:09.833","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86727","references":[{"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-8g4j-g3r6-73xr","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/avideo-through-29.0-information-disclosure-via-stats-json-php","label":"disclosure@vulncheck.com"},{"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-8g4j-g3r6-73xr","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-10T13:52:04.188302Z"},"epss":0.00308,"epssPercentile":0.23775,"ingestedAt":"2026-09-08T15:33:26.987Z","slug":"CVE-2026-86727","body":"## Overview\n\nAVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerate private, unlisted, and group-restricted live streams by parsing the hidden_applications array in the JSON response to obtain sensitive streaming credentials.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":202153,"id":"CVE-2026-86727","ts":1789400064074,"field":"exploit_available","old":"false","new":"true"},{"seq":200880,"id":"CVE-2026-86727","ts":1789397617939,"field":"exploit_available","old":"true","new":"false"},{"seq":199573,"id":"CVE-2026-86727","ts":1789395541908,"field":"exploit_available","old":"false","new":"true"},{"seq":198818,"id":"CVE-2026-86727","ts":1789392245872,"field":"exploit_available","old":"true","new":"false"},{"seq":197151,"id":"CVE-2026-86727","ts":1789384295221,"field":"exploit_available","old":"false","new":"true"},{"seq":196425,"id":"CVE-2026-86727","ts":1789383757528,"field":"exploit_available","old":"true","new":"false"},{"seq":195329,"id":"CVE-2026-86727","ts":1789380575929,"field":"exploit_available","old":"false","new":"true"},{"seq":194280,"id":"CVE-2026-86727","ts":1789378784565,"field":"exploit_available","old":"true","new":"false"},{"seq":193067,"id":"CVE-2026-86727","ts":1789376519097,"field":"exploit_available","old":"false","new":"true"},{"seq":191854,"id":"CVE-2026-86727","ts":1789373632800,"field":"exploit_available","old":"true","new":"false"},{"seq":190639,"id":"CVE-2026-86727","ts":1789369485407,"field":"exploit_available","old":"false","new":"true"},{"seq":189426,"id":"CVE-2026-86727","ts":1789368445097,"field":"exploit_available","old":"true","new":"false"},{"seq":188209,"id":"CVE-2026-86727","ts":1789365235068,"field":"exploit_available","old":"false","new":"true"},{"seq":186996,"id":"CVE-2026-86727","ts":1789363472788,"field":"exploit_available","old":"true","new":"false"},{"seq":185782,"id":"CVE-2026-86727","ts":1789361233702,"field":"exploit_available","old":"false","new":"true"},{"seq":184569,"id":"CVE-2026-86727","ts":1789358365412,"field":"exploit_available","old":"true","new":"false"},{"seq":182819,"id":"CVE-2026-86727","ts":1789354321317,"field":"exploit_available","old":"false","new":"true"},{"seq":181612,"id":"CVE-2026-86727","ts":1789353319885,"field":"exploit_available","old":"true","new":"false"},{"seq":180405,"id":"CVE-2026-86727","ts":1789350286279,"field":"exploit_available","old":"false","new":"true"},{"seq":179198,"id":"CVE-2026-86727","ts":1789348294427,"field":"exploit_available","old":"true","new":"false"},{"seq":177991,"id":"CVE-2026-86727","ts":1789346374459,"field":"exploit_available","old":"false","new":"true"},{"seq":176784,"id":"CVE-2026-86727","ts":1789343186017,"field":"exploit_available","old":"true","new":"false"},{"seq":174901,"id":"CVE-2026-86727","ts":1789334879318,"field":"exploit_available","old":"false","new":"true"},{"seq":173696,"id":"CVE-2026-86727","ts":1789333702311,"field":"exploit_available","old":"true","new":"false"},{"seq":172510,"id":"CVE-2026-86727","ts":1789331094567,"field":"exploit_available","old":"false","new":"true"},{"seq":171324,"id":"CVE-2026-86727","ts":1789328782389,"field":"exploit_available","old":"true","new":"false"},{"seq":170119,"id":"CVE-2026-86727","ts":1789327198655,"field":"exploit_available","old":"false","new":"true"},{"seq":168914,"id":"CVE-2026-86727","ts":1789323841785,"field":"exploit_available","old":"true","new":"false"},{"seq":167709,"id":"CVE-2026-86727","ts":1789319704343,"field":"exploit_available","old":"false","new":"true"},{"seq":166504,"id":"CVE-2026-86727","ts":1789318777682,"field":"exploit_available","old":"true","new":"false"},{"seq":165299,"id":"CVE-2026-86727","ts":1789315808343,"field":"exploit_available","old":"false","new":"true"},{"seq":164094,"id":"CVE-2026-86727","ts":1789313635755,"field":"exploit_available","old":"true","new":"false"},{"seq":162889,"id":"CVE-2026-86727","ts":1789311905962,"field":"exploit_available","old":"false","new":"true"},{"seq":161684,"id":"CVE-2026-86727","ts":1789308734683,"field":"exploit_available","old":"true","new":"false"},{"seq":159797,"id":"CVE-2026-86727","ts":1789300472032,"field":"exploit_available","old":"false","new":"true"},{"seq":156786,"id":"CVE-2026-86727","ts":1789294757241,"field":"exploit_available","old":"true","new":"false"},{"seq":155581,"id":"CVE-2026-86727","ts":1789292969432,"field":"exploit_available","old":"false","new":"true"},{"seq":154376,"id":"CVE-2026-86727","ts":1789289800287,"field":"exploit_available","old":"true","new":"false"},{"seq":151627,"id":"CVE-2026-86727","ts":1789277631293,"field":"exploit_available","old":"false","new":"true"},{"seq":150588,"id":"CVE-2026-86727","ts":1789276255587,"field":"exploit_available","old":"true","new":"false"},{"seq":149555,"id":"CVE-2026-86727","ts":1789273826226,"field":"exploit_available","old":"false","new":"true"},{"seq":148522,"id":"CVE-2026-86727","ts":1789271351135,"field":"exploit_available","old":"true","new":"false"},{"seq":146553,"id":"CVE-2026-86727","ts":1789269400692,"field":"exploit_available","old":"false","new":"true"},{"seq":145358,"id":"CVE-2026-86727","ts":1789266341758,"field":"exploit_available","old":"true","new":"false"},{"seq":144262,"id":"CVE-2026-86727","ts":1789262618159,"field":"exploit_available","old":"false","new":"true"},{"seq":143166,"id":"CVE-2026-86727","ts":1789261535091,"field":"exploit_available","old":"true","new":"false"},{"seq":141997,"id":"CVE-2026-86727","ts":1789258839297,"field":"exploit_available","old":"false","new":"true"},{"seq":140838,"id":"CVE-2026-86727","ts":1789256728597,"field":"exploit_available","old":"true","new":"false"},{"seq":139640,"id":"CVE-2026-86727","ts":1789254833546,"field":"exploit_available","old":"false","new":"true"},{"seq":138442,"id":"CVE-2026-86727","ts":1789251935686,"field":"exploit_available","old":"true","new":"false"}]}