CVE Alert: CVE-2026-86728 – WWBN

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playlist IDs to retrieve sensitive credentials, server identifiers, and complete programme schedules without authentication.

This is a high-risk, remotely exploitable exposure requiring urgent remediation where the affected streaming service is internet-facing, although current enrichment indicates no confirmed exploitation.

The issue can disclose credentials and operational data without an account, creating a credible first step for intrusion, account takeover, or abuse of media infrastructure. Exposure of schedules and server identifiers may also reveal business operations, sensitive programming, or customer-related information. Exploitation is automatable, so broad scanning and opportunistic harvesting are realistic.

### Most likely attack path

An attacker needs only network access: AV:N, AC:L, PR:N and UI:N indicate no special position, credentials, or victim interaction are required. Sequential identifier requests could support bulk enumeration; Scope is unchanged, so direct impact is concentrated on the vulnerable service, but disclosed secrets could enable subsequent movement into connected systems.

### Who is most exposed

Internet-published, self-hosted video portals, broadcasters, community media sites, and installations exposing playlist or electronic-programme-guide functionality are the main concern. Multi-tenant or poorly segmented deployments increase the consequences of leaked keys.

Review web logs for unauthenticated requests to the affected endpoint.

Alert on rapid sequential user or playlist identifier access.

responses and logs for exposed keys, schedules, or server identifiers.

Rotate and investigate any credentials appearing in historical responses.

Check for follow-on authentication or API use from unfamiliar addresses.

### Mitigation and prioritisation

Apply the vendor’s security fix urgently and verify the endpoint no longer responds anonymously.

Restrict external access with authentication, reverse-proxy rules, or temporary endpoint blocking.

Rotate exposed streaming keys and related credentials after patching.

Segment streaming systems from administrative and production networks.

KEV presence and EPSS scoring are not provided; confirm both before final queueing, while SSVC currently indicates no exploitation but high automation potential.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.