CVE-2026-86726CWE-522

CVE-2026-86726

Medium · published September 8, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
28.6
In the wild
Unconfirmed
What it is

AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticated streamers to enumerate source stream keys and identities of all other streamers' active restreams. The endpoint fails to filter results by user ownership, exposing sensitive transmission credentials and streamer identity across all accounts to any user with streaming capability.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00360 · 28.6th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2026-09-08T20:18Z
References (2)
https://github.com/WWBN/AVideo/security/advisories/GHSA-qh45-c3p8-jh4g · [email protected]https://www.vulncheck.com/advisories/avideo-through-29.0-information-disclosure-via-restreamsactive-json-php · [email protected]
EPSS history
Timeline
  • 10 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 08 SEP 15:13Z
    AVideo through 29.0 Information Disclosure via restreamsActive.json.php
    cvelistv5