CVE-2026-86728 is a high severity missing authentication flaw in WWBN AVideo through version 29.0. The plugin/PlayLists/epg.json.php file returns live-stream keys and private programme schedules to any anonymous caller, with no login at all. The GitHub advisory listed no patched version.
What's affected
Affected: WWBN AVideo through version 29.0, per the record and the GitHub advisory. The file is plugin/PlayLists/epg.json.php. The advisory lists patched versions as "None".
Severity differs: the record gives CVSS 3.1 at 7.5 (High), while VulnCheck gives 8.7 on CVSS 4.0, also High, reflecting a stronger confidentiality impact on a downstream system. Both agree on unauthenticated network access. Nothing I read reports exploitation, and the CVE is not in CISA KEV.
How to check if you're exposed
AVideo is usually installed from the project's Git repository, so the commit you run is the version. From the install directory:
git log -1 --format="%H %cd" --date=short
Compare the date and hash with the affected commit, c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23 per the GitHub advisory). Anything at or before that commit is in range. If you run a tagged release, note that the advisory names a master commit, so read the project's security advisories page for the first release or commit that fixes the issue.
Then check whether the plugin named in the advisory is present and enabled in your install (the plugin directory lists them), since an unused plugin is not exposed in the same way, although the files may still be on disk and reachable by URL.
What to do now
- Check your AVideo commit or release against the affected range above.
- Read the AVideo security advisories page for the first fixed commit or release, and update to it as soon as one is listed. At the time of writing the GitHub advisory showed patched versions as "None".
- Block the epg.json.php path at your reverse proxy or web server until the project ships a fix, then rotate live-stream keys.
- Review web server and application logs for unusual requests to the endpoint named in this post.
- Treat the instance as sensitive: keep admin sessions short and avoid browsing other sites while logged in as an administrator.
Why it matters
The class is missing authentication for a critical function (CWE-306). The advisory says the endpoint performs no authentication and serializes an object that includes the live transmission key, a value that is restricted to the owner or an administrator everywhere else in the code. Two sibling EPG endpoints filter playlists through a check that hides private ones. This one omits the filter, so private and non-TV playlists are exposed too.
The leaked key is a credential. With it, someone can publish to or read from a live stream they do not own. The advisory notes the identifiers are sequential, which makes enumeration cheap for anyone who finds the endpoint.
If you run AVideo with live streaming, assume keys exposed through this endpoint should be regenerated once the endpoint is closed.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a login needed to read the data?
No. The advisory describes it as unauthenticated.
What should I rotate?
Live stream keys for any playlist or user whose EPG was reachable. Rotate after you have closed the endpoint, or the new keys leak too.
Sources
Last reviewed: 18 October 2026.
