CVE-2026-91965

WWBN AVideo through 29.0 Broken Access Control via Live Endpoints

High8.7EPSS 0.45%

Published: 15 Sept 2026
Updated: 15 Sept 2026
Reserved: 15 Sept 2026
Assigned by: VulnCheck

Description

WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticated attackers can retrieve restricted live transmission details including stream keys, titles, descriptions, owner information, and direct HLS playback URLs by accessing these endpoints.

Scores

CVSS scores of CVE-2026-91965, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	High8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVDNVD · Deferred	4.0	High8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.45% · top 61% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.

Weakness

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (opens in a new tab)All about CWE-200 and its CVEs

Affected products

WWBN · AVideo
- affected ≤ 29.0

References (2)

GitHub Security Advisory (GHSA-4xhp-wjpj-p92w) (opens in a new tab)vendor-advisoryexploit
VulnCheck Advisory: WWBN AVideo through 29.0 Broken Access Control via Live Endpoints (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-91965](https://trackcve.app/badge/CVE-2026-91965.svg)](https://trackcve.app/cve/CVE-2026-91965)

Record last updated 15 Sept 2026, 15:59 UTC.