Critical CVEs Identified in WWBN AVideo Streaming Platform

Two critical vulnerabilities, CVE-2026-86720 and CVE-2026-86721, were disclosed for the WWBN AVideo platform on September 8, 2026. CVE-2026-86720 allows authenticated users to hijack live streams by manipulating identifiers, while CVE-2026-86721 enables attackers to publish to any user's RTMP stream without authentication using a session cookie override. Both vulnerabilities pose high risks to organizations using AVideo for live streaming, potentially leading to reputational damage and operational disruptions. Internet-facing installations, especially those allowing self-service registration or broad streaming privileges, are particularly vulnerable. Remediation is urgent, with recommendations to apply vendor patches and restrict streaming privileges. No confirmed exploitation has been reported yet, but proof-of-concept code exists for CVE-2026-86720. Organizations are advised to monitor their streaming activity closely and review audit logs for unusual behavior.

Key Points: • CVE-2026-86720 allows stream hijacking via identifier manipulation. • CVE-2026-86721 enables unauthorized publishing to any RTMP stream. • Both vulnerabilities require urgent remediation to prevent reputational damage.