CVE-2026-126541— WWBN AVideo through 29.7.1 Missing Authorization via Live Restream Endpoints

Quick assessment

Affected

WWBN AVideo

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WWBN AVideo 29.7.1 及更早版本存在一个授权缺失漏洞，位于 Live 插件的实时重播（restream）端点。该漏洞允许已认证的流媒体主播通过提供任意的值，获取其他用户的流密钥。攻击者可利用此漏洞，将生成的操作令牌提交至，从而获取受害者的 HLS 流地址和流密钥，进而冒充受害者进行直播，或对其私有直播及按次付费（PPV）直播进行重播。

CVSS 8.1 · High Updated Nov 11, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

WWBN AVideo through 29.7.1 Missing Authorization via Live Restream Endpoints

Source: CVE Program / CVE List V5

Vulnerability Description

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows authenticated streamers to obtain other users' stream keys by supplying arbitrary live_transmitions_history_id values. Attackers can redeem the issued action tokens at verifyTokenForAction.json.php to retrieve victims' HLS URLs and stream keys, then publish as the victim or restream private or pay-per-view lives.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
WWBN	AVideo	0 ~ 29.7.1	-

II. Public POCs for CVE-2026-126541

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-126541

请登录查看更多情报信息。

Other References for CVE-2026-126541 (5)

https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/Live/view/Live_restreams/verifyTokenForAction.json.php#L30-L56 technical-description
https://github.com/WWBN/AVideo/commit/be9d70199279aafe5062744d319fd4df4e5f7a48 patch
https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/Live/view/getRestream.json.php#L27-L48 technical-description
https://github.com/WWBN/AVideo/security/advisories/GHSA-233c-vfmw-6rw9 vendor-advisory
https://www.vulncheck.com/advisories/wwbn-avideo-through-29.7.1-missing-authorization-via-live-restream-endpoints third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-126541

Same Patch Batch · WWBN · 2026-11-11 · 5 CVEs total

CVE-2026-126542	9.8 CRITICAL	WWBN AVideo 6.5 through 29.7.1 Authentication Bypass via Hybridauth Social Login
CVE-2026-126543	7.5 HIGH	WWBN AVideo through 29.7.1 Wallet Credit Manipulation via PayPalYPT ipnV2.php
CVE-2026-126545	4.3 MEDIUM	WWBN AVideo through 29.7.1 Missing Authorization via get_api_tags API
CVE-2026-126544	4.3 MEDIUM	WWBN AVideo 6.5 through 29.7.1 Email Verification Bypass via User::verifyCode()

IV. Related Vulnerabilities

Same product: AVideo

Same vendor: WWBN

Same weakness: CWE-639