CVE-2026-91965
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Sep 15, 2026
Vendor
unknown
Description
WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticated attackers can retrieve restricted live transmission details including stream keys, titles, descriptions, owner information, and direct HLS playback URLs by accessing these endpoints.