CVE-2026-88874 AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 Authentication Bypass
Unauthenticated attackers can bypass password protection on AVideo live streams to retrieve stream keys and watch protected content.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-88874?
CVE-2026-88874 is a high-severity authentication bypass vulnerability in WWBN AVideo, published on 10 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) does not enforce the Live stream password check on the stats endpoint or on the HLS origin. Live::_getStats() (plugin/Live/Live.php) returns a password-protected transmission's RTMP stream key, its isPasswordProtected flag, and its HLS (m3u8) URL to unauthenticated callers, in both the public applications list and the hidden_applications branch used when canSeeLiveFromLiveKey() fails. Separately, the shipped NGINX configuration (deploy/nginx/nginx.conf) serves the .m3u8 playlist, the AES-128 key, and the transport-stream segments from the /live location without any auth_request (the auth_key_check directive in the .key location is commented out). A remote, unauthenticated attacker can therefore retrieve the stream key and decryption key and watch a password-protected live transmission without supplying the configured password. No patched version was available at the time of the advisory.
Weakness: CWE-200
Which versions are affected by CVE-2026-88874?
How do I fix CVE-2026-88874?
No fix has been published for CVE-2026-88874 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-88874 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-88874 exists.
Sources
Also known as GHSA-2hqj-j633-f566, GHSA-7h6j-2gh9-h9rw.