CVE-2026-86720 is a high severity missing authorization flaw in WWBN AVideo through commit c3edcc27. The resendRestreamer.json.php file never checks who owns the live_restreams_id it is given, so a user who can stream may use another user's saved restream destination and stream key. No patched version was listed.
What's affected
Affected: WWBN AVideo up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23). The file is plugin/Live/view/Live_restreams/resendRestreamer.json.php. The GitHub advisory lists patched versions as "None".
Severity differs between sources. The record gives CVSS 3.1 at 8.1 (High). VulnCheck gives 8.6 on CVSS 4.0, also High. Both reflect high confidentiality and integrity impact for an attacker who is logged in with stream permission. Nothing I read reports exploitation, and it is not in CISA KEV.
How to check if you're exposed
AVideo is usually installed from the project's Git repository, so the commit you run is the version. From the install directory:
git log -1 --format="%H %cd" --date=short
Compare the date and hash with the affected commit, c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23 per the GitHub advisory). Anything at or before that commit is in range. If you run a tagged release, note that the advisory names a master commit, so read the project's security advisories page for the first release or commit that fixes the issue.
Then check whether the plugin named in the advisory is present and enabled in your install (the plugin directory lists them), since an unused plugin is not exposed in the same way, although the files may still be on disk and reachable by URL.
What to do now
- Check your AVideo commit or release against the affected range above.
- Read the AVideo security advisories page for the first fixed commit or release, and update to it as soon as one is listed. At the time of writing the GitHub advisory showed patched versions as "None".
- Reduce the number of accounts with stream permission, and rotate stream keys at the destination services if you suspect misuse.
- Review web server and application logs for unusual requests to the endpoint named in this post.
- Treat the instance as sensitive: keep admin sessions short and avoid browsing other sites while logged in as an administrator.
Why it matters
The class is authorization bypass through a user controlled key (CWE-639), often called an insecure direct object reference. The endpoint verifies that you own the live history row you name, but not the restream destination you name. The advisory notes that sibling files in the same directory do compare the owner to the current user, and this one does not.
The identifier is a sequential integer, so guessing neighbours is cheap. The destinations hold stream keys for services such as YouTube, Facebook or Twitch. Using a victim's key lets a different broadcaster push content to the victim's channel, which can mean reputational harm, platform strikes or a hijacked live event.
The remedy is a one line ownership check, the same one the siblings use. Until it ships, access control at the application edge is your option.
Quick check
Who can exploit this?
An authenticated user with permission to stream, per the record. Ordinary viewers without that permission are outside the described attack.
Why does the stream key matter?
A stream key is the credential that authorizes broadcasting to a channel. Anyone holding it can publish to that destination.
Sources
Last reviewed: 18 October 2026.
